High · published February 5, 2025
When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
| Product | Versions | Fixed in |
|---|---|---|
| netapp/hci_baseboard_management_controller | all versions | — |
| netapp/hci_h610s_firmware | all versions | — |
| netapp/hci_h610c_firmware | all versions | — |
| netapp/hci_h615c_firmware | all versions | — |
| netapp/solidfire_\&_hci_management_node | all versions | — |
| netapp/solidfire_\&_hci_storage_node | all versions | — |
| haxx/curl | ≥ 7.10.5, < 8.12.0 | 8.12.0 |
| haxx/libcurl | ≥ 7.10.5, < 8.12.0 | 8.12.0 |