ALPINE-CVE-2016-8624 — Vulnetix

Try Vulnetix Request Demo

ALPINE-CVE-2016-8624 PUBLISHED CVSS 7.5 HIGH

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

Risk Scores

CVSS v3.0

7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions
Alpine:v3.15	curl	7.50.2-r0, 7.50.1-r0, 7.50.0-r0
Alpine:v3.17	curl	7.50.3-r1, 7.50.3-r0, 7.50.2-r0
Alpine:v3.11	curl	0, 7.19.2-r0, 7.19.2-r1
Alpine:v3.3	curl	7.34.0-r1, 7.34.0-r0, 7.33.0-r1
Alpine:v3.8	curl	7.34.0-r1, 7.50.3-r1, 7.50.3-r0
Alpine:v3.21	curl	7.19.2-r0, 0, 7.50.3-r1
Alpine:v3.20	curl	0, 7.41.0-r0, 7.40.0-r0
Alpine:v3.18	curl	7.41.0-r0, 7.41.0-r0, 7.40.0-r0
Alpine:v3.4	curl	7.50.3-r0, 7.50.2-r0, 7.50.1-r0
Alpine:v3.12	curl	7.46.0-r1, 0, 7.19.2-r0
Alpine:v3.6	curl	7.19.7-r0, 7.19.7-r1, 7.20.1-r0
Alpine:v3.10	curl	7.42.1-r0, 7.42.1-r1, 7.43.0-r0
Alpine:v3.16	curl	7.44.0-r0, 7.43.0-r0, 7.42.1-r1
Alpine:v3.2	curl	7.47.0-r0, 7.49.1-r3, 7.49.1-r2
Alpine:v3.14	curl	7.42.0-r0, 7.50.3-r1, 7.50.3-r0
Alpine:v3.5	curl	7.24.0-r0, 7.23.1-r0, 7.22.0-r0
Alpine:v3.19	curl	7.50.0-r0, 7.41.0-r0, 7.40.0-r0
Alpine:v3.13	curl	7.50.1-r0, 7.50.3-r1, 7.50.3-r0
Alpine:v3.9	curl	7.50.3-r1, 7.50.3-r0, 7.50.2-r0
Alpine:v3.23	curl	7.50.3-r1, 7.50.3-r0, 7.50.2-r0

…and 2 more

Timeline

Jul 31, 2018 CVE Published
Dec 3, 2025 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://security.alpinelinux.org/vuln/CVE-2016-8624 advisory

Open in Interactive Console →