SASL buffer overflow

{
  "id": "52a79d3c4df2a168675a4d522c21456f0db5663adcd48a759544755747b2d925",
  "url": "https://osv.dev/vulnerability/CURL-CVE-2013-0249",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SASL buffer overflow",
    "summary": "libcurl is vulnerable to a buffer overflow vulnerability when communicating with one of the protocols POP3, SMTP or IMAP. When negotiating SASL DIGEST-MD5 authentication, the function `Curl_sasl_create_digest_md5_message()` uses the data provided from the server without doing the proper length checks and that data is then appended to a local fixed-size buffer on the stack. This vulnerability can be exploited by someone who is in control of a server that a libcurl based program is accessing with POP3, SMTP or IMAP. For applications that accept user provided URLs, it is also thinkable that a malicious user would feed an application with a URL to a server hosting code targeting this flaw. This vulnerability can be used for remote code execution (RCE) on vulnerable systems. Both curl the command line tool and applications using the libcurl library are vulnerable.",
    "evidence": "osv:CURL-CVE-2013-0249",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CURL-CVE-2013-0249",
      "aliases": [
        "CURL-CVE-2013-0249",
        "CVE-2013-0249"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "7.26.0"
                },
                {
                  "fixed": "7.29.0"
                }
              ]
            },
            {
              "repo": "https://github.com/curl/curl.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "7a2647e16237a2771f564d432d96a6f198a0eeb5"
                },
                {
                  "fixed": "f206d6c055d1008f0edb6d5d5920f0f300b9983a"
                }
              ]
            }
          ],
          "versions": [
            "7.28.1",
            "7.28.0",
            "7.27.0",
            "7.26.0",
            "curl-7_28_1",
            "curl-7_28_0",
            "curl-7_27_0",
            "curl-7_26_0"
          ],
          "database_specific": {
            "source": "https://curl.se/docs/CURL-CVE-2013-0249.json",
            "vanir_signatures": [
              {
                "id": "CURL-CVE-2013-0249-88744018",
                "digest": {
                  "length": 4266,
                  "function_hash": "159391975882008358046898390206799100549"
                },
                "source": "https://github.com/curl/curl.git/commit/f206d6c055d1008f0edb6d5d5920f0f300b9983a",
                "target": {
                  "file": "lib/curl_sasl.c",
                  "function": "Curl_sasl_create_digest_md5_message"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CURL-CVE-2013-0249-a569fc09",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "59989511861975177197361190156011432999",
                    "79579512590841082603164474932071731662",
                    "280453228738073661817826478685497407137",
                    "89506625971535947860175017236046226369",
                    "280895666484554560101695128847421768899",
                    "214629372157697119510915090251166590170",
                    "268642237863843770458260403252438799062",
                    "133091462680146701100609491552370693002",
                    "100792198256655150588026348540955117693",
                    "303297278804503501138318908643242344458",
                    "252888240415055316092147798385173021894",
                    "78930870528873899365754725093369671660",
                    "160209090977147466735938990453470296139",
                    "255727790287437403619558305177521440112",
                    "269602557028209153456599712038229022145",
                    "258541154434129167735701533018457405107",
                    "279509673037591907073454375417859274411",
                    "333299968035789361455698972428679370330",
                    "134336826008439941072535355758939692634",
                    "120815187918675627194893807768291083729",
                    "213951811613322502726307840617377267874",
                    "207796728171759773922263521994711152364",
                    "268429273683657545495713929968282586452"
                  ]
                },
                "source": "https://github.com/curl/curl.git/commit/f206d6c055d1008f0edb6d5d5920f0f300b9983a",
                "target": {
                  "file": "lib/curl_sasl.c"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              }
            ],
            "vanir_signatures_modified": "2026-10-25T01:04:46Z"
          }
        }
      ],
      "modified": "2026-10-25T01:04:46.908556906Z",
      "provider": "osv",
      "references": [],
      "provider_metadata": {
        "CWE": {
          "id": "CWE-121",
          "desc": "Stack-based Buffer Overflow"
        },
        "URL": "https://curl.se/docs/CVE-2013-0249.json",
        "www": "https://curl.se/docs/CVE-2013-0249.html",
        "affects": "both",
        "package": "curl",
        "severity": "Critical",
        "last_affected": "7.28.1"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2013-0249",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 444289,
  "published_at": "2013-02-06T08:00:00+00:00"
}