---
cve: "CVE-2016-8625"
severity: "MEDIUM"
cvss: 5.3
epss: "4.3%"
vendor: "The Curl Project"
kev: false
exploited: false
published: "2018-08-01 06:29:00"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-16T07:26:11+02:00"
---

# CVE-2016-8625

> 5.3 MEDIUM

## Beschreibung

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.

## CVSS-Vektor

```
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Keine | good |

## Patch verfügbar (OSV)

- 3c561c657c2f0e553b19115a506592a8bbd744bc (Commit)

## Referenzen

- <http://www.securityfocus.com/bid/94107>
- <https://curl.haxx.se/CVE-2016-8625.patch>
- <https://access.redhat.com/errata/RHSA-2018:3558>
- <https://www.tenable.com/security/tns-2016-21>
- <https://curl.haxx.se/docs/adv_20161102K.html>
- <http://www.securitytracker.com/id/1037192>
- <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625>
- <https://access.redhat.com/errata/RHSA-2018:2486>
- <https://security.gentoo.org/glsa/201701-47>
- <https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E>
- <https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2016-8625) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_