Medium
invalid URL parsing with '#'
Type: advisorySources: OSV
curl does not parse the authority component of the URL correctly when the host name part ends with a hash (`#`) character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use a URL parser that follows the RFC to check for allowed domains before using curl to request them. Passing in `http://example.com#@evil.com/x.txt` would wrongly make curl send a request to evil.com while your browser would connect to example.com given the same URL. The problem exists for most protocol schemes.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-8624
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:39 UTC · Revision 1
Source evidence
curl does not parse the authority component of the URL correctly when the host name part ends with a hash (`#`) character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use a URL parser that follows the RFC to check for allowed domains before using curl to request them. Passing in `http://example.com#@evil.com/x.txt` would wrongly make curl send a request to evil.com while your browser would connect to example.com given the same URL. The problem exists for most protocol schemes.
osv:CURL-CVE-2016-8624
Complete source record
{
"id": "826e8aadb16875de84b4607899bcf6f6b25782a2fd067366d76fb4d5ea8bfd0f",
"url": "https://osv.dev/vulnerability/CURL-CVE-2016-8624",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "invalid URL parsing with '#'",
"summary": "curl does not parse the authority component of the URL correctly when the host name part ends with a hash (`#`) character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use a URL parser that follows the RFC to check for allowed domains before using curl to request them. Passing in `http://example.com#@evil.com/x.txt` would wrongly make curl send a request to evil.com while your browser would connect to example.com given the same URL. The problem exists for most protocol schemes.",
"evidence": "osv:CURL-CVE-2016-8624",
"products": [],
"severity": "medium",
"structured": {
"id": "CURL-CVE-2016-8624",
"aliases": [
"CURL-CVE-2016-8624",
"CVE-2016-8624"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "6.0"
},
{
"fixed": "7.51.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "ae1912cb0d494b48d514d937826c9fe83ec96c4d"
},
{
"fixed": "3bb273db7e40ebc284cff45f3ce3f0475c8339c2"
}
]
}
],
"versions": [
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0",
"7.42.1",
"7.42.0",
"7.41.0",
"7.40.0",
"7.39.0",
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"7.32.0",
"7.31.0",
"7.30.0",
"7.29.0",
"7.28.1",
"7.28.0",
"7.27.0",
"7.26.0",
"7.25.0",
"7.24.0",
"7.23.1",
"7.23.0",
"7.22.0",
"7.21.7",
"7.21.6",
"7.21.5",
"7.21.4",
"7.21.3",
"7.21.2",
"7.21.1",
"7.21.0",
"7.20.1",
"7.20.0",
"7.19.7",
"7.19.6",
"7.19.5",
"7.19.4",
"7.19.3",
"7.19.2",
"7.19.1",
"7.19.0",
"7.18.2",
"7.18.1",
"7.18.0",
"7.17.1",
"7.17.0",
"7.16.4",
"7.16.3",
"7.16.2",
"7.16.1",
"7.16.0",
"7.15.5",
"7.15.4",
"7.15.3",
"7.15.2",
"7.15.1",
"7.15.0",
"7.14.1",
"7.14.0",
"7.13.2",
"7.13.1",
"7.13.0",
"7.12.3",
"7.12.2",
"7.12.1",
"7.12.0",
"7.11.2",
"7.11.1",
"7.11.0",
"7.10.8",
"7.10.7",
"7.10.6",
"7.10.5",
"7.10.4",
"7.10.3",
"7.10.2",
"7.10.1",
"7.10",
"7.9.8",
"7.9.7",
"7.9.6",
"7.9.5",
"7.9.4",
"7.9.3",
"7.9.2",
"7.9.1",
"7.9",
"7.8.1",
"7.8",
"7.7.3",
"7.7.2",
"7.7.1",
"7.7",
"7.6.1",
"7.6",
"7.5.2",
"7.5.1",
"7.5",
"7.4.2",
"7.4.1",
"7.4",
"7.3",
"7.2.1",
"7.2",
"7.1.1",
"7.1",
"6.5.2",
"6.5.1",
"6.5",
"6.4",
"6.3.1",
"6.3",
"6.2",
"6.1",
"6.0",
"curl-7_50_3",
"curl-7_50_2",
"curl-7_50_1",
"curl-7_50_0",
"curl-7_49_1",
"curl-7_49_0",
"curl-7_48_0",
"curl-7_47_1",
"curl-7_47_0",
"curl-7_46_0",
"curl-7_45_0",
"curl-7_44_0",
"curl-7_43_0",
"curl-7_42_1",
"curl-7_42_0",
"curl-7_41_0",
"curl-7_40_0",
"curl-7_39_0",
"curl-7_38_0",
"curl-7_37_1",
"curl-7_37_0",
"curl-7_36_0",
"curl-7_35_0",
"curl-7_34_0",
"curl-7_33_0",
"curl-7_32_0",
"curl-7_31_0",
"curl-7_30_0",
"curl-7_29_0",
"curl-7_28_1",
"curl-7_28_0",
"curl-7_27_0",
"curl-7_26_0",
"curl-7_25_0",
"curl-7_24_0",
"curl-7_23_1",
"curl-7_23_0",
"curl-7_22_0",
"curl-7_21_7",
"curl-7_21_6",
"curl-7_21_5",
"curl-7_21_4",
"curl-7_21_3",
"curl-7_21_2",
"curl-7_21_1",
"curl-7_21_0",
"curl-7_20_1",
"curl-7_20_0",
"curl-7_19_7",
"curl-7_19_6",
"curl-7_19_5",
"curl-7_19_4",
"curl-7_19_3",
"curl-7_19_2",
"curl-7_19_1",
"curl-7_19_0",
"curl-7_18_2",
"curl-7_18_1",
"curl-7_18_0",
"curl-7_17_1",
"curl-7_17_0",
"curl-7_17_0-preldapfix",
"curl-7_16_4",
"curl-7_16_3",
"curl-7_16_2",
"curl-7_16_1",
"curl-7_16_0",
"curl-7_15_6-prepipeline",
"curl-7_15_5",
"curl-7_15_4",
"curl-7_15_3",
"curl-7_15_2",
"curl-7_15_1",
"curl-7_15_0",
"curl-7_14_1",
"curl-7_14_0",
"curl-7_13_2",
"curl-7_13_1",
"before_ftp_statemachine",
"curl-7_13_0",
"curl-7_12_3",
"curl-7_12_2",
"curl-7_12_1",
"curl-7_12_0",
"curl-7_11_2",
"curl-7_11_1",
"curl-7_11_0",
"curl-7_10_8",
"curl-7_10_7",
"curl-7_10_6",
"curl-7_10_5",
"curl-7_10_4",
"curl-7_10_3",
"curl-7_10_2",
"curl-7_10_1",
"curl-7_10",
"curl-7_9_8",
"curl-7_9_7",
"curl-7_9_7-pre2",
"curl-7_9_6",
"curl-7_9_5",
"curl-7_9_5-pre4",
"curl-7_9_5-pre2",
"curl-7_9_4",
"curl-7_9_3",
"curl-7_9_3-pre3",
"curl-7_9_3-pre2",
"curl-7_9_3-pre1",
"curl-7_9_2",
"curl-7_9_1",
"curl-7_9",
"before_urldata_rename",
"curl-7_8_1",
"curl-7_8_1-pre3",
"curl-7_8",
"curl-7_8-pre2",
"curl-7_7_3",
"curl-7_7_2",
"curl-7_7_1",
"curl-7_7",
"curl-7_7-beta5",
"curl-7_7-beta3",
"curl-7_7-beta2",
"curl-7_7-beta1",
"curl-7_7_alpha2",
"curl-7_6_1",
"curl-7_6_1-pre3",
"curl-7_6_1-pre2",
"curl-7_6_1-pre1",
"curl-7_6",
"curl-7_6-pre4",
"curl_7_6-pre3",
"curl-7_5_2",
"curl-7_5",
"curl-7_4_1",
"curl-7_3",
"curl-7_2",
"curl-7_1_1",
"curl-6_5_2",
"curl-6_5_1",
"curl-6_5"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2016-8624.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2016-8624-21dabb6c",
"digest": {
"length": 5303,
"function_hash": "192314251346490770842994228226152588855"
},
"source": "https://github.com/curl/curl.git/commit/3bb273db7e40ebc284cff45f3ce3f0475c8339c2",
"target": {
"file": "lib/url.c",
"function": "parseurlandfillconn"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2016-8624-e5a561b6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"167794969187132834335283326240322298758",
"2145756531567107512094677782452244826",
"323747900718285867694470904862247761631",
"72199516645593183555100184296947424249",
"103006003645429430163277688968008968563",
"175770485043618483373585366884754774864",
"129035539822800012486235675867282881458",
"185182450701402718154549178776349809532",
"70106979273968636074962406029356647628",
"56254145538747740195693065556051579026",
"168788442069164588453201833074777156037",
"170526936898557974342460186685632420595"
]
},
"source": "https://github.com/curl/curl.git/commit/3bb273db7e40ebc284cff45f3ce3f0475c8339c2",
"target": {
"file": "lib/url.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:05:28Z"
}
}
],
"modified": "2026-10-25T01:05:28.168294694Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-172",
"desc": "Encoding Error"
},
"URL": "https://curl.se/docs/CVE-2016-8624.json",
"www": "https://curl.se/docs/CVE-2016-8624.html",
"affects": "both",
"package": "curl",
"severity": "Medium",
"last_affected": "7.50.3"
}
},
"related_cves": [
{
"value": "CVE-2016-8624",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444389,
"published_at": "2016-11-02T08:00:00+00:00"
}