{"id":"CVE-2016-9952","details":"The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by \"*.com.\"","aliases":["CURL-CVE-2016-9952"],"modified":"2026-05-18T10:52:44.529197Z","published":"2018-03-12T21:29:00.500Z","references":[{"type":"ADVISORY","url":"https://curl.haxx.se/CVE-2016-9952.patch"},{"type":"ADVISORY","url":"https://curl.haxx.se/docs/adv_20161221B.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/curl/curl","events":[{"introduced":"80d241046e404233537ff35efabb703a0668c7d5"},{"last_affected":"3c561c657c2f0e553b19115a506592a8bbd744bc"}],"database_specific":{"source":"CPE_FIELD","extracted_events":[{"introduced":"7.30.0"},{"last_affected":"7.51.0"}],"cpe":"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"}}],"versions":["curl-7_51_0","curl-7_50_3","curl-7_50_2","curl-7_50_1","curl-7_50_0","curl-7_49_1","curl-7_49_0","curl-7_48_0","curl-7_47_1","curl-7_47_0","curl-7_46_0","curl-7_45_0","curl-7_44_0","curl-7_43_0","curl-7_42_0","curl-7_41_0","curl-7_40_0","curl-7_39_0","curl-7_38_0","curl-7_37_1","curl-7_37_0","curl-7_36_0","curl-7_35_0","curl-7_34_0","curl-7_33_0","curl-7_32_0","curl-7_31_0","curl-7_30_0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-9952.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}