An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
CVE-2017-1000257
CRITICALNVD 9.19.1—
EchelonGraph scoreMEDIUM confidence
Score 9.1 from GitHub Security Advisory (severity: CRITICAL) published 2022-05-14. NVD baseline CVSS 9.1; sources differ by 0.0.
Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, nvd
9.1EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
- High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 6.2%CVSS: 9.1Exploit: None knownExposed services: —
A fix is available — apply it.
Internet exposure
The internet-exposure footprint is temporarily unavailable — the KEV-Exposure radar's record for this CVE could not be loaded just now. That is not a finding of zero exposed services; please retry shortly.
- CVSS v3
- 9.1
- EG Score
- 9.1CRITICALmedium confidence
- EG Risk
- 58EG Risk 58/100CISA SSVC
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity91% × 45%Exploitation6% × 40%Automatability100% × 15%CISA SSVC: Track at low or medium mission impact; Attend at high (mission-essential systems).Action: A fix is available. Apply it within your standard update timelines at low or medium mission impact and sooner than that at high. - EPSS PROB
- 6.2%
- EPSS %ILE
- 93rd
- KEV
- Not listed
CISA SSVCTrack at low or medium mission impact; Attend at high (mission-essential systems).
A fix is available. Apply it within your standard update timelines at low or medium mission impact and sooner than that at high.
Exploitation none (CISA Vulnrichment) · Automatable yes (CISA Vulnrichment) · Technical impact partial (CISA Vulnrichment). Mission impact is CISA's Mission & Well-being decision point, and only you can judge it: high means the affected system is essential to your organisation's mission, or its compromise could cause irreversible harm to people. CISA's decision table
Published
October 31, 2017
Last Modified
June 17, 2026
Advisory Details
Enriched advisory details are temporarily unavailable — they could not be loaded just now. That is not a sign that none exist; please retry shortly.
References (16)
- cve@mitrehttp://www.debian.org/security/2017/dsa-4007
- cve@mitrehttp://www.securityfocus.com/bid/101519
- cve@mitrehttp://www.securitytracker.com/id/1039644
- cve@mitrehttps://access.redhat.com/errata/RHSA-2017:3263
- cve@mitrehttps://access.redhat.com/errata/RHSA-2018:2486
- cve@mitrehttps://access.redhat.com/errata/RHSA-2018:3558
- cve@mitrehttps://curl.haxx.se/docs/adv_20171023.html
- cve@mitrehttps://security.gentoo.org/glsa/201712-04
- af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2017/dsa-4007
- af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/101519
- af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1039644
- af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:3263
- af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:2486
- af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:3558
- af854a3a-2127-422b-91ae-364da2661108https://curl.haxx.se/docs/adv_20171023.html
Vendor Advisories for CVE-2017-1000257
Vendor advisories for this CVE are temporarily unavailable — the list could not be loaded just now. That is not a sign that none exist; please retry shortly.
Affected Packages
(29 across 29 ecosystems)
Alpine:v3.10(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.11(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.12(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.13(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.14(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.15(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.16(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.17(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.18(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.19(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.20(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.21(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.22(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.23(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.24(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.3(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.4(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.5(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.6(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.7(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.8(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Alpine:v3.9(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Debian:11(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Debian:12(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Debian:13(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Debian:14(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | — |
| — |
Debian:7(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | 7.26.0-1+wheezy10 ... 7.26.0-1+wheezy9 (20 versions) |
| — |
Debian:8(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | 7.38.0-4 ... 7.38.0-4+deb8u6 (7 versions) |
| — |
Debian:9(1)
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| curl | 7.52.1-5, 7.52.1-5+deb9u1 |
| — |
Related CVEs(same product + same vendor + same CWE)· as of October 4, 2026
Same product
10 shownAlpine:v3.3:curl
- CVE-2017-1000100EG 6.5EPSS p90MEDIUM
- CVE-2017-1000101EG 6.5EPSS p90MEDIUM
- CVE-2016-8619NVD 5.3EG 9.8EPSS p92CRITICAL
- CVE-2016-8622NVD 3.7EG 9.8EPSS p91CRITICAL
- CVE-2016-8618NVD 5.3EG 9.8EPSS p92CRITICAL
- CVE-2016-7167EG 9.8EPSS p96CRITICAL
- CVE-2016-8623NVD 3.3EG 7.5HIGH
- CVE-2016-8615NVD 5.3EG 7.5EPSS p92HIGH
- CVE-2016-8621NVD 5.3EG 7.5EPSS p92HIGH
- CVE-2016-8624NVD 5.3EG 7.5EPSS p93HIGH
Same vendor
10 shownredhat:RHSA-2018:2486 · redhat:RHSA-2018:3558
- CVE-2017-1000254EG 7.5EPSS p95HIGH
- CVE-2016-8619NVD 5.3EG 9.8EPSS p92CRITICAL
- CVE-2016-8622NVD 3.7EG 9.8EPSS p91CRITICAL
- CVE-2016-8618NVD 5.3EG 9.8EPSS p92CRITICAL
- CVE-2016-7167EG 9.8EPSS p96CRITICAL
- CVE-2016-9586NVD 5.9EG 8.1EPSS p92HIGH
- CVE-2016-8625NVD 5.3EG 7.5EPSS p91HIGH
- CVE-2016-8623NVD 3.3EG 7.5HIGH
- CVE-2016-8615NVD 5.3EG 7.5EPSS p92HIGH
- CVE-2016-8621NVD 5.3EG 7.5EPSS p92HIGH
Frequently asked(5)
What is CVE-2017-1000257?
CVE-2017-1000257 is a critical vulnerability published on October 31, 2017. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a…
When was CVE-2017-1000257 disclosed?
CVE-2017-1000257 was first published on October 31, 2017, with the most recent update on June 17, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2017-1000257 actively exploited?
CVE-2017-1000257 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 6.2% probability of exploitation in the next 30 days (93rd percentile of EPSS-scored CVEs).
What is the CVSS score of CVE-2017-1000257?
CVE-2017-1000257 has a CVSS v3 base score of 9.1 (NVD).
How do I remediate CVE-2017-1000257?
A fix for CVE-2017-1000257 is available: update to the fixed version the vendor names in its advisory.
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2017-1000257
Is Your Infrastructure Affected by CVE-2017-1000257?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.