CURL-CVE-2014-2522

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2014-2522.html
Import Source
https://curl.se/docs/CURL-CVE-2014-2522.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2014-2522
Aliases
  • CVE-2014-2522
Published
2014-03-26T08:00:00Z
Modified
2026-05-27T02:29:26.552537Z
Summary
not verifying certs for TLS to IP address / Schannel
Details

When asked to do a TLS connection (HTTPS, FTPS, IMAPS, etc) to a URL specified with an IP address instead of a name, libcurl would wrongly not verify the server's name in the certificate. The signature (whether it was signed by a trusted CA) and validity (whether the date was within the certificate's lifetime and it was not revoked) verification was still performed.

This is a problem in libcurl built to use the Schannel TLS backend. Schannel is the native library provided by Microsoft Windows.

Only users on Windows can be affected by this, and only if libcurl was built to use the native TLS backend library.

Database specific 
{
    "severity": "Medium",
    "www": "https://curl.se/docs/CVE-2014-2522.html",
    "URL": "https://curl.se/docs/CVE-2014-2522.json",
    "last_affected": "7.35.0",
    "affects": "both",
    "package": "curl",
    "CWE": {
        "desc": "Improper Validation of Certificate with Host Mismatch",
        "id": "CWE-297"
    }
}
References
Credits
    • David Ryskalczyk - FINDER
    • David Ryskalczyk - REMEDIATION_DEVELOPER
    • Marc Hoersken - OTHER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
7.27.0
Fixed
7.36.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
aaa42aa0d594b95c6c670a373ba30c507aa0a5ed
Fixed
63fc8ee7be2b712e7af5029f4f8a86a0dfd71b38

Affected versions

7.*
7.27.0
7.28.0
7.28.1
7.29.0
7.30.0
7.31.0
7.32.0
7.33.0
7.34.0
7.35.0
Other
curl-7_27_0
curl-7_28_0
curl-7_28_1
curl-7_29_0
curl-7_30_0
curl-7_31_0
curl-7_32_0
curl-7_33_0
curl-7_34_0
curl-7_35_0

Database specific

vanir_signatures_modified 
"2026-05-27T02:29:26Z"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "target": {
            "file": "lib/vtls/curl_schannel.c",
            "function": "schannel_connect_step1"
        },
        "deprecated": false,
        "source": "https://github.com/curl/curl.git/commit/63fc8ee7be2b712e7af5029f4f8a86a0dfd71b38",
        "id": "CURL-CVE-2014-2522-65f911ef",
        "signature_version": "v1",
        "digest": {
            "function_hash": "201114652427706738740804130433342670756",
            "length": 5212.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "lib/vtls/curl_schannel.c"
        },
        "deprecated": false,
        "source": "https://github.com/curl/curl.git/commit/63fc8ee7be2b712e7af5029f4f8a86a0dfd71b38",
        "id": "CURL-CVE-2014-2522-72d96fcb",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "37067894196444900397617705016039623743",
                "161768383064884761262690179874875144343",
                "82500998688114360303281786540641069544",
                "289399917483318758033777927158434858866",
                "332600585901512242754128816846775029390",
                "96034512906067914464259407389070079807",
                "248455268525012668894381651065346837303",
                "252858979942174794365535322041206415414",
                "36255879304211910177030073595527677586",
                "65508394054464198753753981692666982439",
                "107607901544107254571541286663980946099",
                "281175509784847119433452659265058060331",
                "220146253374254298395958640922488755668",
                "128202501759524298133555426942877081053",
                "293810268716254750755126383521910622768"
            ],
            "threshold": 0.9
        }
    }
]
source 
"https://curl.se/docs/CURL-CVE-2014-2522.json"