The vulnerability arises in curl when the command‑line tool is invoked with the remote header name option that is meant to protect existing files from being overwritten. A malicious server can bypass this no‑clobber guarantee by returning an intermediate HTTP 103 Early Hints response or by ordering headers in a way that tricks curl into treating existing files as new downloads. This allows an attacker who controls the remote server to overwrite any file that curl creates on the client system during a transfer.

The affected product is curl, a widely used command‑line HTTP client. The specific vendor and item versions are not identified in the data provided, but any installation that uses the -J option or implements the associated no‑clobber logic is potentially vulnerable.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. The most likely attack vector involves a remote server having control over HTTP responses sent to a client that uses curl to fetch resources. If that server is trusted or if the client indiscriminately downloads from untrusted origins, the attacker can overwrite arbitrary files on the client’s filesystem, potentially compromising system integrity.