---
id: CVE-2019-5435
title: >-
  An integer overflow in curl's URL API results in a buffer overflow in libcurl
  7.62.0 to and including 7.64.1.
summary: >-
  An integer overflow in curl's URL API results in a buffer overflow in libcurl
  7.62.0 to and including 7.64.1.
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-131
  - CWE-190
vendor: haxx
product: curl
affected:
  - 'curl >= 7.62.0, <= 7.64.1'
published: '2019-05-28'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:54.377'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-5435'
references:
  - url: 'https://curl.haxx.se/docs/CVE-2019-5435.html'
    label: support@hackerone.com
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/
    label: support@hackerone.com
  - url: 'https://security.gentoo.org/glsa/202003-29'
    label: support@hackerone.com
  - url: 'https://security.netapp.com/advisory/ntap-20190606-0004/'
    label: support@hackerone.com
  - url: 'https://support.f5.com/csp/article/K08125515'
    label: support@hackerone.com
  - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html'
    label: support@hackerone.com
  - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html'
    label: support@hackerone.com
  - url: >-
      https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    label: support@hackerone.com
  - url: 'https://curl.haxx.se/docs/CVE-2019-5435.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202003-29'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20190606-0004/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.f5.com/csp/article/K08125515'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-5435.json
  - url: 'https://access.redhat.com/security/cve/CVE-2019-5435'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1710609'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2019-5435'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-5435'
  - url: 'https://access.redhat.com/errata/RHSA-2020:4384'
  - url: 'https://access.redhat.com/errata/RHSA-2020:4383'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.04063
epssPercentile: 0.90448
ingestedAt: '2026-10-14T07:21:04.813Z'
patched:
  - jboss_core_services_on_rhel_6_server
  - jboss_core_services_on_rhel_7_server
  - jboss_core_services
---

## Overview

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.

## Affected

- `curl >= 7.62.0, <= 7.64.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2020:4384** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 6 Server, Red Hat JBoss Core Services on RHEL 7 Server · released 2020-10-28 · [advisory](https://access.redhat.com/errata/RHSA-2020:4384)
- **RHSA-2020:4383** · Red Hat · fixed in: Red Hat JBoss Core Services · released 2020-10-28 · [advisory](https://access.redhat.com/errata/RHSA-2020:4383)