CURL-CVE-2014-2522

    Dashboard / Vulnerabilities / CURL-CVE-2014-2522

    CURL-CVE-2014-2522

    Published: 26 Mar 2014Last Modified: 27 May 2026
    Aliases:
    CVE-2014-2522

    Summary: not verifying certs for TLS to IP address / Schannel

    Details: When asked to do a TLS connection (HTTPS, FTPS, IMAPS, etc) to a URL specified with an IP address instead of a name, libcurl would wrongly not verify the server's name in the certificate. The signature (whether it was signed by a trusted CA) and validity (whether the date was within the certificate's lifetime and it was not revoked) verification was still performed. This is a problem in libcurl built to use the Schannel TLS backend. Schannel is the native library provided by Microsoft Windows. Only users on Windows can be affected by this, and only if libcurl was built to use the native TLS backend library.

    References:

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 7.27.0
    Fixed -7.36.0

    Affected versions

    7.35.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CURL-CVE-2014-2522 | CVE-DB