CVE-2013-4545: cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name f...

Security readout for executives and security teams

This flaw affects older cURL/libcurl builds using OpenSSL. If an application disabled certificate trust checking, libcurl also stopped checking that the certificate name matched the server. A network attacker could impersonate an HTTPS server using any otherwise valid certificate. Exposure is most likely in legacy systems or bundled applications still using cURL/libcurl 7.18.0 through 7.32.0 with OpenSSL, especially where applications set CURLOPT_SSL_VERIFYPEER off. Current supported distributions are less likely affected if vendor security updates were applied. Treat as a targeted legacy TLS risk. Prioritize internet-facing, sensitive-data, update, payment, authentication, and API integrations that depend on old libcurl versions or explicitly disabled certificate verification. Mitigation focus: Inventory systems and applications using cURL or libcurl.; Identify versions 7.18.0 through 7.32.0 built with OpenSSL.; Apply vendor curl/libcurl security updates or upgrade outside the affected range..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.