The developers and maintainers of the popular open-source command line tool cURL (short for “Client URL”) are warning users about the presence of an unpatched critical vulnerability affecting both cURL and libcurl, the portable client-side URL transfer library that powers cURL. The cURL tool allows users to transfer data over various network protocols like FTP(S), HTTP(S), IMAP(S), LDAP(S), MQTT, POP3, RTMP(S), SCP, SFTP, SMB(S), SMTP(S), TELNET, WS, and WSS. It communicates with a web or application server by specifying a relevant URL and the data that needs to be sent or received. cURL is widely used as both a standalone utility as well as one that is included as part of other software. At this time the technical details are being withheld until patched on October 11, 2023, and according to the cURL maintainers this is “probably the worst curl security flaw in a long time.” Although affected versions of cURL haven’t been disclosed, the maintainers say organizations should assume it affects all versions over the past few years. In preparation for the October 11 patch, organizations relying on cURL should inventory and scan all systems utilizing curl and libcurl, “anticipating identifying potentially vulnerable versions once details are disclosed with the release of cURL 8.4.0.” Alongside the critical vulnerability, the cURL developers will also be patching a low-severity vulnerability, tracked as CVE-2023-38546, that only impacts libcurl. CTIX analysts urge any administrators leveraging cURL to get ahead of this matter as soon as possible. Inventorying all of the configuration and version details prior to the patch will allow them to implement the patch as soon as needed on the 11th. It should be assumed that when the cURL developers publish the technical details, multiple threat actors will be attempting to exploit entities that are still running a vulnerable version of the tool.