duphandle read out of bounds
libcurl's function [`curl_easy_duphandle()`](https://curl.se/libcurl/c/curl_easy_duphandle.html) has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending. When doing an HTTP POST transfer with libcurl, you can use the `CURLOPT_COPYPOSTFIELDS` option to specify a memory area holding the data to send to the remote server. The memory area's size is set with a separate option, for example `CURLOPT_POSTFIELDSIZE`. As the name implies, the data in the specified buffer is copied to a privately held memory buffer that libcurl allocates on the heap. The memory area is associated with the common CURL handle, often referred to as an "easy handle". This handle can be duplicated by an application to create an identical copy, and all the already set options and data is then also similarly cloned and are be associated with the newly returned handle. This also includes the data to send in an HTTP POST request. The internal libcurl function that duplicates options from the old handle to the new had two problems: 1. It mistakenly treated the post data buffer as if it was a C string which is assumed to end with a zero byte. `strdup()` was subsequently used to duplicate the post data buffer, and as a post data buffer can both legitimately contain a zero byte, or may not contain any zero bytes at all (including a tailing one), `strdup()` could create a copy that a) was too small b) was too large or c) could crash due to reading an inaccessible mem
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2014-3707
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 14:10 UTC · Revision 1
Source evidence
libcurl's function [`curl_easy_duphandle()`](https://curl.se/libcurl/c/curl_easy_duphandle.html) has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending. When doing an HTTP POST transfer with libcurl, you can use the `CURLOPT_COPYPOSTFIELDS` option to specify a memory area holding the data to send to the remote server. The memory area's size is set with a separate option, for example `CURLOPT_POSTFIELDSIZE`. As the name implies, the data in the specified buffer is copied to a privately held memory buffer that libcurl allocates on the heap. The memory area is associated with the common CURL handle, often referred to as an "easy handle". This handle can be duplicated by an application to create an identical copy, and all the already set options and data is then also similarly cloned and are be associated with the newly returned handle. This also includes the data to send in an HTTP POST request. The internal libcurl function that duplicates options from the old handle to the new had two problems: 1. It mistakenly treated the post data buffer as if it was a C string which is assumed to end with a zero byte. `strdup()` was subsequently used to duplicate the post data buffer, and as a post data buffer can both legitimately contain a zero byte, or may not contain any zero bytes at all (including a tailing one), `strdup()` could create a copy that a) was too small b) was too large or c) could crash due to reading an inaccessible mem
osv:CURL-CVE-2014-3707
Complete source record
{
"id": "07b924ea70473a9292ebe89f0b90ab708ff85d2f52b075e8fc2efb04441e5a9a",
"url": "https://osv.dev/vulnerability/CURL-CVE-2014-3707",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "duphandle read out of bounds",
"summary": "libcurl's function [`curl_easy_duphandle()`](https://curl.se/libcurl/c/curl_easy_duphandle.html) has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending. When doing an HTTP POST transfer with libcurl, you can use the `CURLOPT_COPYPOSTFIELDS` option to specify a memory area holding the data to send to the remote server. The memory area's size is set with a separate option, for example `CURLOPT_POSTFIELDSIZE`. As the name implies, the data in the specified buffer is copied to a privately held memory buffer that libcurl allocates on the heap. The memory area is associated with the common CURL handle, often referred to as an \"easy handle\". This handle can be duplicated by an application to create an identical copy, and all the already set options and data is then also similarly cloned and are be associated with the newly returned handle. This also includes the data to send in an HTTP POST request. The internal libcurl function that duplicates options from the old handle to the new had two problems: 1. It mistakenly treated the post data buffer as if it was a C string which is assumed to end with a zero byte. `strdup()` was subsequently used to duplicate the post data buffer, and as a post data buffer can both legitimately contain a zero byte, or may not contain any zero bytes at all (including a tailing one), `strdup()` could create a copy that a) was too small b) was too large or c) could crash due to reading an inaccessible mem",
"evidence": "osv:CURL-CVE-2014-3707",
"products": [],
"severity": "medium",
"structured": {
"id": "CURL-CVE-2014-3707",
"aliases": [
"CURL-CVE-2014-3707",
"CVE-2014-3707"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.17.1"
},
{
"fixed": "7.39.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "a005243908803662d4a05427bc1061db42f4d057"
},
{
"fixed": "b3875606925536f82fc61f3114ac42f29eaf6945"
}
]
}
],
"versions": [
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"7.32.0",
"7.31.0",
"7.30.0",
"7.29.0",
"7.28.1",
"7.28.0",
"7.27.0",
"7.26.0",
"7.25.0",
"7.24.0",
"7.23.1",
"7.23.0",
"7.22.0",
"7.21.7",
"7.21.6",
"7.21.5",
"7.21.4",
"7.21.3",
"7.21.2",
"7.21.1",
"7.21.0",
"7.20.1",
"7.20.0",
"7.19.7",
"7.19.6",
"7.19.5",
"7.19.4",
"7.19.3",
"7.19.2",
"7.19.1",
"7.19.0",
"7.18.2",
"7.18.1",
"7.18.0",
"7.17.1",
"curl-7_38_0",
"curl-7_37_1",
"curl-7_37_0",
"curl-7_36_0",
"curl-7_35_0",
"curl-7_34_0",
"curl-7_33_0",
"curl-7_32_0",
"curl-7_31_0",
"curl-7_30_0",
"curl-7_29_0",
"curl-7_28_1",
"curl-7_28_0",
"curl-7_27_0",
"curl-7_26_0",
"curl-7_25_0",
"curl-7_24_0",
"curl-7_23_1",
"curl-7_23_0",
"curl-7_22_0",
"curl-7_21_7",
"curl-7_21_6",
"curl-7_21_5",
"curl-7_21_4",
"curl-7_21_3",
"curl-7_21_2",
"curl-7_21_1",
"curl-7_21_0",
"curl-7_20_1",
"curl-7_20_0",
"curl-7_19_7",
"curl-7_19_6",
"curl-7_19_5",
"curl-7_19_4",
"curl-7_19_3",
"curl-7_19_2",
"curl-7_19_1",
"curl-7_19_0",
"curl-7_18_2",
"curl-7_18_1",
"curl-7_18_0",
"curl-7_17_1"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2014-3707.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2014-3707-03498fa6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"127571066005132162394745191923884517624",
"306855933067502983715764933279888462311",
"91060711549293819246264217108642030968"
]
},
"source": "https://github.com/curl/curl.git/commit/b3875606925536f82fc61f3114ac42f29eaf6945",
"target": {
"file": "lib/strdup.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2014-3707-11a57db3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"129298132073041536944664025260326182039",
"239702622003577815249827896257371415293",
"37497796442319528728356356946320297389",
"50511109997338752191747529832489437678",
"125619229616138215407405593786760479300",
"240722840557483599925104181589324838311",
"33845740491327782352534394365632947359"
]
},
"source": "https://github.com/curl/curl.git/commit/b3875606925536f82fc61f3114ac42f29eaf6945",
"target": {
"file": "lib/urldata.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2014-3707-2d7fdc82",
"digest": {
"threshold": 0.9,
"line_hashes": [
"22306682436834823501630275824150313801",
"20776544305130466555450839562021879277",
"273358153699374406904001317490768220079",
"136709100517555571331149291988908774938",
"94429222468059406260443728599541867546",
"174318347801918917686760719650140640997",
"96643347226974641701170155531945275907",
"321214453539548569238046639930733814032",
"26336765544803095149733232658070574997",
"186704602833126890221715069355212519572",
"114454303754977092933321085447264941650",
"155075612908956902314496691759118726988",
"305005554224787913639393503277250549183",
"228115507322447502145039830437182506879",
"185268294029470670340884360872795449703",
"243332892173211569376949855804818823101",
"24907725470708723708620865375724034689",
"53869237590415649549477673759734538793",
"176838158067409776339076543113428402801",
"113165488259472493467622466365262947987",
"117566606413402916147237928734089976100",
"271107065030406318996112848145352678982",
"287867308427333719334013902902392956113",
"286406101195422919601083661160813815281",
"56736811544708235017330412852232410293",
"81611418550183497221452332295536881569",
"120707839261971390066012322269582231904",
"96775504690441182770073860884995001590",
"223995813380883419723566274384202165381",
"126439255895949456309129519038037579678",
"143453635562264697250647265418465810557",
"92187300181622084530623726049634949594",
"241923890620897570780740098613708804534",
"252712694429003674281080735411264528147",
"304966159299857115907988570534341842637",
"59641601321821936101925502626342787257",
"178892985363044022540304650940762924386"
]
},
"source": "https://github.com/curl/curl.git/commit/b3875606925536f82fc61f3114ac42f29eaf6945",
"target": {
"file": "lib/formdata.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2014-3707-2ef64453",
"digest": {
"length": 360,
"function_hash": "215924022680873290960701840680837484005"
},
"source": "https://github.com/curl/curl.git/commit/b3875606925536f82fc61f3114ac42f29eaf6945",
"target": {
"file": "lib/url.c",
"function": "Curl_dupset"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2014-3707-38cdf01e",
"digest": {
"length": 451,
"function_hash": "113854088363596928821767849924549151241"
},
"source": "https://github.com/curl/curl.git/commit/b3875606925536f82fc61f3114ac42f29eaf6945",
"target": {
"file": "lib/url.c",
"function": "Curl_freeset"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2014-3707-af1c8d6e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"40145494751895804483008986691324965876",
"84301932536949980142156924115975494625",
"282603490254191649278375414908006474536"
]
},
"source": "https://github.com/curl/curl.git/commit/b3875606925536f82fc61f3114ac42f29eaf6945",
"target": {
"file": "lib/strdup.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2014-3707-bcbce1d2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"17426772181790665441557795541900412206",
"94973511136313106404228339467384188914",
"155198010483977611199283641354757594757",
"173430800232111982329218609679174522391",
"111698974490817653165854127599581931010"
]
},
"source": "https://github.com/curl/curl.git/commit/b3875606925536f82fc61f3114ac42f29eaf6945",
"target": {
"file": "src/tool_setup.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2014-3707-e20c82d2",
"digest": {
"length": 8017,
"function_hash": "5556267963239337546597570854659173619"
},
"source": "https://github.com/curl/curl.git/commit/b3875606925536f82fc61f3114ac42f29eaf6945",
"target": {
"file": "lib/formdata.c",
"function": "FormAdd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2014-3707-ea6c5e1a",
"digest": {
"length": 366,
"function_hash": "201497487499556814808944622573532087303"
},
"source": "https://github.com/curl/curl.git/commit/b3875606925536f82fc61f3114ac42f29eaf6945",
"target": {
"file": "lib/formdata.c",
"function": "memdup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2014-3707-fcf805fd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303288721676213784639202977825522151208",
"229249824435197849533923946099329247390",
"286228150832337009201418527297455319085",
"20095838013593815384638579341654322216",
"108321902383835956833218880080549409645",
"216800543307533131292713499941086939837",
"183358955210925759933869720621755541743",
"184305315549737823605923689608782431658",
"302414039201736881985752941628724929563",
"24315820867967428968221623999303070676",
"67858107384099389004586052435526421647",
"134542077974657439486722749974518057990",
"334908238417817183525192926123354507277",
"29094884245390009385225671834772044758",
"139363817470183645437986724500212541397",
"235780497829215147823977033612277444840",
"123401432769732433524703311801133114312",
"162030365013041997462971438198938991437"
]
},
"source": "https://github.com/curl/curl.git/commit/b3875606925536f82fc61f3114ac42f29eaf6945",
"target": {
"file": "lib/url.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-26T13:07:54Z"
}
}
],
"modified": "2026-10-26T13:07:54.518132451Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-126",
"desc": "Buffer Over-read"
},
"URL": "https://curl.se/docs/CVE-2014-3707.json",
"www": "https://curl.se/docs/CVE-2014-3707.html",
"affects": "lib",
"package": "curl",
"severity": "Medium",
"last_affected": "7.38.0"
}
},
"related_cves": [
{
"value": "CVE-2014-3707",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 453276,
"published_at": "2014-11-05T08:00:00+00:00"
}