JLSEC-2025-37
- Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-37.md
- Import Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-37.json
- JSON Data
- https://api.osv.dev/v1/vulns/JLSEC-2025-37
- Upstream
- Published
- 2025-10-10T15:04:01.319Z
- Modified
- 2026-07-25T18:23:43.119964643Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- libcurl's URL API function [`curl_url_get()`](https://curl.se/libcurl/c/curl_url_get.html) offers...
- Details
-
libcurl's URL API function
curl_url_get()offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string.This flaw can lead to stack contents accidently getting returned as part of the converted string.
- Database specific
{ "sources": [ { "database_specific": { "status": "Modified" }, "id": "CVE-2024-6874", "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6874", "modified": "2026-06-17T08:18:53.063Z", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-6874", "published": "2024-07-24T08:15:03.413Z", "imported": "2026-07-17T21:01:35.339Z" } ], "license": "CC-BY-4.0" }- References