{
  "schema_version": "1.5.0",
  "id": "CURL-CVE-2014-2522",
  "aliases": [
    "CVE-2014-2522"
  ],
  "summary": "not verifying certs for TLS to IP address / Schannel",
  "modified": "2026-04-25T17:48:46.00Z",
  "database_specific": {
    "package": "curl",
    "affects": "both",
    "URL": "https://curl.se/docs/CVE-2014-2522.json",
    "www": "https://curl.se/docs/CVE-2014-2522.html",
    "CWE": {
      "id": "CWE-297",
      "desc": "Improper Validation of Certificate with Host Mismatch"
    },
    "last_affected": "7.35.0",
    "severity": "Medium"
  },
  "published": "2014-03-26T08:00:00.00Z",
  "affected": [
    {
      "ranges": [
        {
           "type": "SEMVER",
           "events": [
             {"introduced": "7.27.0"},
             {"fixed": "7.36.0"}
           ]
        },
        {
           "type": "GIT",
           "repo": "https://github.com/curl/curl.git",
           "events": [
             {"introduced": "aaa42aa0d594b95c6c670a373ba30c507aa0a5ed"},
             {"fixed": "63fc8ee7be2b712e7af5029f4f8a86a0dfd71b38"}
           ]
        }
      ],
      "versions": [
        "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", 
        "7.28.1", "7.28.0", "7.27.0"
      ]
    }
  ],
  "credits": [
    {
      "name": "David Ryskalczyk",
      "type": "FINDER"
    },
    {
      "name": "David Ryskalczyk",
      "type": "REMEDIATION_DEVELOPER"
    },
    {
      "name": "Marc Hoersken",
      "type": "OTHER"
    }
  ],
  "details": "When asked to do a TLS connection (HTTPS, FTPS, IMAPS, etc) to a URL specified\nwith an IP address instead of a name, libcurl would wrongly not verify the\nserver's name in the certificate. The signature (whether it was signed by a\ntrusted CA) and validity (whether the date was within the certificate's\nlifetime and it was not revoked) verification was still performed.\n\nThis is a problem in libcurl built to use the Schannel TLS backend.\nSchannel is the native library provided by Microsoft Windows.\n\nOnly users on Windows can be affected by this, and only if libcurl was built\nto use the native TLS backend library."
}