{
  "schema_version": "1.5.0",
  "id": "CURL-CVE-2009-2417",
  "aliases": [
    "CVE-2009-2417"
  ],
  "summary": "embedded zero in cert name",
  "modified": "2026-05-19T11:21:50.00Z",
  "database_specific": {
    "package": "curl",
    "affects": "both",
    "URL": "https://curl.se/docs/CVE-2009-2417.json",
    "www": "https://curl.se/docs/CVE-2009-2417.html",
    "CWE": {
      "id": "CWE-170",
      "desc": "Improper Null Termination"
    },
    "last_affected": "7.19.5",
    "severity": "High"
  },
  "published": "2009-08-12T08:00:00.00Z",
  "affected": [
    {
      "ranges": [
        {
           "type": "SEMVER",
           "events": [
             {"introduced": "7.4"},
             {"fixed": "7.19.6"}
           ]
        }      ],
      "versions": [
        "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", 
        "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", 
        "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", 
        "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", 
        "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8", 
        "7.10.7", "7.10.6", "7.10.5", "7.10.4", "7.10.3", "7.10.2", "7.10.1", 
        "7.10", "7.9.8", "7.9.7", "7.9.6", "7.9.5", "7.9.4", "7.9.3", 
        "7.9.2", "7.9.1", "7.9", "7.8.1", "7.8", "7.7.3", "7.7.2", 
        "7.7.1", "7.7", "7.6.1", "7.6", "7.5.2", "7.5.1", "7.5", 
        "7.4.2", "7.4.1", "7.4"
      ]
    }
  ],
  "credits": [
    {
      "name": "Scott Cantor",
      "type": "FINDER"
    },
    {
      "name": "Daniel Stenberg",
      "type": "REMEDIATION_DEVELOPER"
    },
    {
      "name": "Peter Sylvester",
      "type": "OTHER"
    },
    {
      "name": "Michal Marek",
      "type": "OTHER"
    },
    {
      "name": "Kamil Dudka",
      "type": "OTHER"
    }
  ],
  "details": "SSL and TLS Server certificates contain one or more fields with server name\nor otherwise matching patterns. These strings are stored as content and\nlength within the certificate, and thus there is no particular terminating\ncharacter.\n\ncurl's OpenSSL interfacing code did faulty assumptions about those names and\npatterns being null-terminated, allowing itself to be fooled in case a\ncertificate would get a zero byte embedded into one of the name fields. To\nillustrate, a name that would show this vulnerability could look like:\n\n  \"example.com\\0.haxx.se\"\n\nThis cert is thus made for \"haxx.se\" but curl would erroneously verify it\nwith no complaints for \"example.com\".\n\nAccording to a recently published presentation, this kind of zero embedding\nhas been proven to be possible with at least one CA."
}