CVE-2020-8285: Apple Mac OS X

High severity, CVSS 7.5. EPSS: 9.8% chance of exploitation in the next 30 days.

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

Affected products

Apple Mac OS X: before 10.14.6 (fixed in 10.14.6); from 10.15, before 10.15.7 (fixed in 10.15.7); version 10.14.6 only; version 10.15.7 only
Apple macOS: from 11.0, before 11.3 (fixed in 11.3)
Debian Debian Linux: version 9.0 only; version 10.0 only
Fedoraproject Fedora: version 32 only; version 33 only
Fujitsu m10-1 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Fujitsu m10-4 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Fujitsu m10-4s Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Fujitsu m12-1 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Fujitsu m12-2 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Fujitsu m12-2s Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Haxx Libcurl: from 7.21.0, before 7.74.0 (fixed in 7.74.0)
Netapp Clustered Data Ontap: affected versions not specified
Netapp Hci Bootstrap OS: affected versions not specified
Netapp Hci Management Node: affected versions not specified
Netapp Hci Storage Node Firmware: affected versions not specified
Netapp Solidfire: affected versions not specified
Oracle Communications Billing And Revenue Management: version 12.0.0.3.0 only
Oracle Communications Cloud Native Core Policy: version 1.14.0 only
Oracle Essbase: version 21.2 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only
Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2020-12-14. Last modified 2026-06-17.