CVE-2014-1263: curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in App...

Security readout for executives and security teams

This flaw affected curl/libcurl TLS checks in a narrow configuration. When connecting to an HTTPS URL written as a numeric IP address, affected versions could accept a certificate for another name, enabling a network-positioned attacker to impersonate the server. Exposure is most likely in legacy macOS OS X 10.9.x before 10.9.2 or bundled curl/libcurl 7.27.0-7.35.0 builds using SecureTransport/Darwinssl, especially scripts or applications that contact HTTPS endpoints by IP address. Treat this as a legacy exposure cleanup item unless affected systems are still in production or used on untrusted networks. Prioritize systems handling credentials, automation secrets, package retrieval, or administrative connections over HTTPS by IP address. Mitigation focus: Upgrade Apple OS X 10.9.x systems to 10.9.2 or later where applicable.; Upgrade curl/libcurl beyond the affected 7.27.0 through 7.35.0 range.; Check vendor advisories for bundled curl/libcurl in downstream products..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.