CVE-2016-3739

—

CVSS 3.0

5.3 medium

EPSS

7%p94

Published

May 20, 2016 (May 20, 2016)

Modified

Jun 17, 2026

Description

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.

Vendors: haxx
Products: curl
Weakness: CWE-20
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (6.9%)

In the news0 stories

No ingested article mentions this CVE yet.