{
  "schema_version": "1.5.0",
  "id": "CURL-CVE-2019-5443",
  "aliases": [
    "CVE-2019-5443"
  ],
  "summary": "Windows OpenSSL engine code injection",
  "modified": "2026-04-25T17:48:46.00Z",
  "database_specific": {
    "package": "curl",
    "affects": "both",
    "URL": "https://curl.se/docs/CVE-2019-5443.json",
    "www": "https://curl.se/docs/CVE-2019-5443.html",
    "issue": "https://hackerone.com/reports/608577",
    "CWE": {
      "id": "CWE-94",
      "desc": "Improper Control of Generation of Code ('Code Injection')"
    },
    "award": {
      "amount": "200",
      "currency": "USD"
    },
    "last_affected": "7.65.1",
    "severity": "High"
  },
  "published": "2019-06-24T08:00:00.00Z",
  "affected": [
    {
      "ranges": [
        {
           "type": "SEMVER",
           "events": [
             {"introduced": "7.44.0"},
             {"fixed": "7.66.0"}
           ]
        }      ],
      "versions": [
        "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", 
        "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", 
        "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", 
        "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", 
        "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0"
      ]
    }
  ],
  "credits": [
    {
      "name": "Rich Mirch",
      "type": "FINDER"
    },
    {
      "name": "Viktor Szakats",
      "type": "REMEDIATION_DEVELOPER"
    }
  ],
  "details": "A non-privileged user or program can put code and a config file in a known\nnon-privileged path (under `C:/usr/local/`) that makes curl automatically run\nthe code (as an OpenSSL \"engine\") on invocation. If that curl is invoked by a\nprivileged user it can do anything it wants.\n\nThis flaw exists in the official curl-for-windows binaries built and hosted by\nthe curl project (all versions up to and including 7.65.1_1). It **does not**\nexist in the curl executable shipped by Microsoft, bundled with Windows 10. It\npossibly exists in other curl builds for Windows too that uses OpenSSL.\n\nThe curl project has provided official curl executable builds for Windows\nsince [late August\n2018](https://daniel.haxx.se/blog/2018/08/27/blessed-curl-builds-for-windows/).\n\nThere exists proof of concept exploits of this flaw."
}