CURL-CVE-2014-1263

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2014-1263.html
Import Source
https://curl.se/docs/CURL-CVE-2014-1263.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2014-1263
Aliases
  • CVE-2014-1263
Published
2014-03-26T08:00:00Z
Modified
2026-05-27T02:29:18.645786Z
Summary
not verifying certs for TLS to IP address / Secure Transport
Details

When asked to do a TLS connection (HTTPS, FTPS, IMAPS, etc) to a URL specified with an IP address instead of a name, libcurl would wrongly not verify the server's name in the certificate. The signature (whether it was signed by a trusted CA) and validity (whether the date was within the certificate's lifetime and it was not revoked) verification was still performed.

This is a problem in libcurl built to use the Secure Transport backend. Secure Transport is the TLS library present and used on Mac OS X and iOS.

Only users on Mac OS X or iOS can be affected by this, and only if libcurl was built to use the native TLS backend library.

This problem was initially used as an example of the Apple SSL bug that hit the news in late February 2014 but that was not correct.

Database specific 
{
    "affects": "both",
    "package": "curl",
    "CWE": {
        "desc": "Improper Validation of Certificate with Host Mismatch",
        "id": "CWE-297"
    },
    "severity": "Medium",
    "URL": "https://curl.se/docs/CVE-2014-1263.json",
    "last_affected": "7.35.0",
    "www": "https://curl.se/docs/CVE-2014-1263.html"
}
References
Credits
    • Roland Moriz - FINDER
    • David Ryskalczyk - REMEDIATION_DEVELOPER
    • Nick Zitzmann - OTHER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
7.27.0
Fixed
7.36.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
6d1ea388cbd9de7f2a944a0c64f5feaec1b1904a
Fixed
afc6e5004fabee590e41ffe750a237e1187fbbbd
Fixed
e9665e9658307894e75b5037ab31809a026c891e

Affected versions

7.*
7.27.0
7.28.0
7.28.1
7.29.0
7.30.0
7.31.0
7.32.0
7.33.0
7.34.0
7.35.0
Other
curl-7_27_0
curl-7_28_0
curl-7_28_1
curl-7_29_0
curl-7_30_0
curl-7_31_0
curl-7_32_0
curl-7_33_0
curl-7_34_0
curl-7_35_0

Database specific

vanir_signatures 
[
    {
        "digest": {
            "length": 12664.0,
            "function_hash": "118892292214048643035672840983136210857"
        },
        "deprecated": false,
        "source": "https://github.com/curl/curl.git/commit/afc6e5004fabee590e41ffe750a237e1187fbbbd",
        "signature_type": "Function",
        "target": {
            "file": "lib/vtls/curl_darwinssl.c",
            "function": "darwinssl_connect_step1"
        },
        "signature_version": "v1",
        "id": "CURL-CVE-2014-1263-46deb206"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "316255875844261537459574858674279425871",
                "239378137043493369965312323354307456067",
                "204640828372644162492254219113765752460",
                "219459843959473681948300350369099033059",
                "58683795751729623030046900533268359601",
                "68010053885667392452433109099392771147",
                "326748351302449136049322361015970921228",
                "244996404508351932339435100811283724032",
                "208098070630273559268760496294166926428",
                "131374684106720825121641423745765234123",
                "264295880985067059370503250389482572375",
                "316499748253954725996549419519249869439",
                "304252583710625668890348546343893798971",
                "319139195181975568023432909836975337027"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/curl/curl.git/commit/afc6e5004fabee590e41ffe750a237e1187fbbbd",
        "signature_type": "Line",
        "target": {
            "file": "lib/vtls/curl_darwinssl.c"
        },
        "signature_version": "v1",
        "id": "CURL-CVE-2014-1263-8945bbe3"
    }
]
source 
"https://curl.se/docs/CURL-CVE-2014-1263.json"
vanir_signatures_modified 
"2026-05-27T02:29:18Z"