A 25-year-old vulnerability has been patched in Curl, the widely used open source data transfer tool. The latest version addresses 18 medium and low-severity security issues, according to SecurityWeek.
The patched flaw, which dates back to the tool's early development, underscores the persistence of legacy code risks in critical infrastructure. No specific CVE identifier or CVSS score was disclosed for the oldest vulnerability.
Technical details remain sparse, but the vulnerabilities collectively affect how Curl handles data transfers, potentially exposing systems to man-in-the-middle attacks or data corruption. Affected versions include all prior builds of the utility.
Users are urged to update to the latest Curl release immediately. No workarounds have been published for unpatched systems, and the maintainers have not indicated whether the flaws have been actively exploited in the wild.
The patch highlights a broader challenge in open source maintenance: legacy vulnerabilities can persist for decades in foundational tools. The Curl team did not attribute the disclosure to any specific researcher or security firm.