CVE-2019-5481: Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

Security readout for executives and security teams

CVE-2019-5481 is a critical memory handling flaw in cURL’s FTP Kerberos code. Affected versions are 7.52.0 through 7.65.3. Because cURL and libcurl are widely embedded in operating systems, applications, and appliances, the business concern is hidden dependency exposure rather than only standalone curl binaries. Exposure is most likely where curl or libcurl 7.52.0 through 7.65.3 is present, especially in systems that can exercise FTP with Kerberos. Downstream Linux and vendor advisories indicate packaged or embedded dependency exposure may exist beyond direct application ownership. Treat this as a high-priority dependency remediation item, especially for internet-connected or automation-heavy environments. The urgency comes from critical severity and curl’s broad reuse, while exploitation evidence in the provided sources remains unconfirmed. Mitigation focus: Inventory curl and libcurl versions across servers, containers, applications, and appliances.; Upgrade affected versions to a vendor-supported fixed package or version outside 7.52.0 through 7.65.3.; Prioritize systems using FTP, Kerberos, or libcurl in network-facing workflows..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.