VULNERABILITY INTELLIGENCE
CVE-2016-5420
CVSS score7.5 HIGH
EPSS probability15.36%
CISA KEVNot currently listed
Published2016-08-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.
Weakness classification
- CWE-285: Improper Authorization