CVE-2019-5481

What it actually does

Double-free in FTP-kerberos handling leads to heap memory corruption that can be leveraged for remote code execution.

Why it matters to the business

Compromise of systems running vulnerable cURL versions can result in full system takeover, data theft, or service disruption across many downstream products and distributions.

How an attack unfolds

An attacker establishes an FTP session that triggers kerberos authentication, then supplies crafted server responses that cause the client to free the same memory buffer twice, allowing control of execution flow.

How to fix it

Upgrade cURL to version 7.66.0 or later on all affected systems and rebuild any statically linked applications.

How to confirm the fix worked

Confirm installed cURL version is 7.66.0 or newer; run regression tests against FTP-kerberos flows and monitor process stability under crafted traffic.

Typical attack path

1. Initiate FTP connection requesting kerberos authentication
2. Return specially crafted FTP replies that exercise the vulnerable code path
3. Trigger double-free to corrupt heap metadata
4. Achieve arbitrary code execution or denial of service

How to detect it

Review application and system logs for cURL crashes or segfaults during FTP sessions that involve kerberos; inspect network captures for unusual FTP response patterns around authentication exchanges.

What your security team should do

• Inventory all hosts and containers using cURL 7.52.0-7.65.3 and schedule immediate upgrades
• Block or monitor outbound FTP traffic to untrusted servers until patches are applied
• Add version checks to build pipelines and dependency scanners