CVE-2020-8285: Buffer Overflow

cURL libcurl is vulnerable to a denial of service, caused by a stack-based buffer overflow in the wildcard matching function. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause the application to crash.

— IBM

curl. A buffer overflow was addressed with improved input validation.

libcurl offers a wildcard matching functionality, which allows a callback (set with CURLOPTCHUNKBGNFUNCTION) to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. When this callback returns CURLCHUNKBGNFUNCSKIP, to tell libcurl to not deal with that file, the internal function in libcurl then calls itself recursively to handle the next directory entry. If there's a sufficient amount of file entries and if the callback returns "skip" enough number of times, libcurl runs out of stack space. The exact amount will of course vary with platforms, compilers and other environmental factors.

— Red Hat