Every CVE Search/ Get API key

CVE-2026-8458

wrong reuse for different services

6.5 MediumFix available

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.37%Up 0.2 points since Jul 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

wrong reuse for different services

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
CVE-2026-8458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-488
Updated
2026-11-02
EUVDEUVD-2026-41504 6.5

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
EUVD-2026-41504
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-88c6-6jfq-mm4q 6.5

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate...

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
GHSA-88c6-6jfq-mm4q
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-488
Updated
2026-11-02
NVD 6.5

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
CVE-2026-8458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-488
Updated
2026-11-02
OSVALPINE-CVE-2026-8458 6.5

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
ALPINE-CVE-2026-8458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-8458 6.5
Record
BELL-CVE-2026-8458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 36 moreShow less
OSV 6.5

wrong reuse for different services

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
CVE-2026-8458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-488
Updated
2026-11-03
OSVDEBIAN-CVE-2026-8458 6.5

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
DEBIAN-CVE-2026-8458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVJLSEC-2026-1212 6.5

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate...

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
JLSEC-2026-1212
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:29017 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:29017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:34975 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:34975
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:69125 8.1

Red Hat Security Advisory: curl security update

Record
RHSA-2026:69125
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:69126 8.1

Red Hat Security Advisory: curl security update

Record
RHSA-2026:69126
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:72506 8.1

Red Hat Security Advisory: curl security update

Record
RHSA-2026:72506
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:69125 8.1

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

  • curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

  • libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69125
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:69126 8.1

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

  • curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69126
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:92368 8.1

Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

  • curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

  • Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to Rocky Linux 8 libcurl (JIRA:Rocky Linux-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92368
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-8458 6.5

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
UBUNTU-CVE-2026-8458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:69125 No score

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
  • curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)
  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
  • libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69125
Updated
2026-11-02
OSVALSA-2026:69126 No score

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
  • curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69126
Updated
2026-11-02
OSVALSA-2026:92368 No score

Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
  • curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

  • Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to AlmaLinux 8 libcurl (JIRA:RHEL-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92368
Updated
2026-11-02
OSVAZL-91809 No score

CVE-2026-8458 affecting package curl for versions less than 8.11.1-10

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
AZL-91809
Updated
2026-11-05
OSVAZL-91824 No score

CVE-2026-8458 affecting package cmake for versions less than 3.30.3-15

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
AZL-91824
Updated
2026-11-05
OSVCLSA-2026-1786091577 No score

curl: Fix of 2 CVEs

  • CVE-2026-8458: tie the requested SASL/SPNEGO service name to the connection and compare it when matching an existing connection for reuse, so a Negotiate authenticated connection is not reused for a transfer that asked for a different service
  • CVE-2026-8926: discard a .netrc entry that matches the host but whose login does not match the user given in the URL, so the password that belongs to another user of that host is no longer returned as a successful lookup
Record
CLSA-2026-1786091577
Updated
2026-11-02
OSVCLSA-2026-1786094315 No score

curl: Fix of 2 CVEs

  • CVE-2026-8458: tie the requested SASL/SPNEGO service name to the connection and compare it when matching an existing connection for reuse, so a Negotiate authenticated connection is not reused for a transfer that asked for a different service
  • CVE-2026-8926: discard a .netrc entry that matches the host but whose login does not match the user given in the URL, so the password that belongs to another user of that host is no longer returned as a successful lookup
Record
CLSA-2026-1786094315
Updated
2026-11-02
OSVCLSA-2026-1790236735 No score

Fix CVE(s): CVE-2026-8286, CVE-2026-8458

  • SECURITY UPDATE: connection reuse with a mismatching TLS configuration for STARTTLS protocols
    • debian/patches/CVE-2026-8286.patch: also require a matching SSL configuration when looking for a connection to reuse for a transfer that may upgrade to TLS from a clear-text start in lib/url.c
    • CVE-2026-8286
  • SECURITY UPDATE: connection reuse across different GSS-API service names
    • debian/patches/CVE-2026-8458.patch: keep the service name and the proxy service name on the connection and compare them when looking for a connection to reuse in lib/urldata.h, lib/url.c and lib/http_negotiate.c
    • CVE-2026-8458
Record
CLSA-2026-1790236735
Updated
2026-11-02
OSVCLSA-2026-1791344648 No score

Fix CVE(s): CVE-2026-8458

  • SECURITY UPDATE: wrong connection reuse for different Negotiate services
    • debian/patches/CVE-2026-8458.patch: store the (proxy) service name on the connection and only reuse a connection when the same service names are asked for in lib/url.c, lib/urldata.h and lib/http_negotiate.c.
    • CVE-2026-8458
Record
CLSA-2026-1791344648
Updated
2026-11-02
OSVCURL-CVE-2026-8458 No score

wrong reuse for different services

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Record
CURL-CVE-2026-8458
Updated
2026-11-02
OSVopenSUSE-SU-2026:11230-1 No score

curl-8.21.0-1.1 on GA media

These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11230-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21272-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
openSUSE-SU-2026:21272-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-8458 No score

CVE-2026-8458 in curl - Patched by Root

Root has patched CVE-2026-8458 in the curl package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-8458
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-8458 No score

CVE-2026-8458 in curl - Patched by Root

Root has patched CVE-2026-8458 in the curl package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-8458
Updated
2026-11-04
OSVROOT-OS-DEBIAN-13-CVE-2026-8458 No score

CVE-2026-8458 in curl - Patched by Root

Root has patched CVE-2026-8458 in the curl package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-8458
Updated
2026-11-03
OSVSUSE-SU-2026:22553-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:22553-1
Updated
2026-11-02
OSVSUSE-SU-2026:22582-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:22582-1
Updated
2026-11-02
OSVSUSE-SU-2026:22709-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:22709-1
Updated
2026-11-02
OSVSUSE-SU-2026:22889-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:22889-1
Updated
2026-11-02
OSVSUSE-SU-2026:2925-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).
  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:2925-1
Updated
2026-11-02
OSVSUSE-SU-2026:2926-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:2926-1
Updated
2026-11-02
OSVSUSE-SU-2026:3043-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:3043-1
Updated
2026-11-02
OSVSUSE-SU-2026:3814-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
Record
SUSE-SU-2026:3814-1
Updated
2026-11-02
OSVSUSE-SU-2026:5071-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
  • CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
  • CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
  • CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
  • CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
  • CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
  • CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
  • CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
  • CVE-2026-92389: TFTP direction confusion (bsc#1285015).
  • CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
  • CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
Record
SUSE-SU-2026:5071-1
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.23
 7.46.0 up to 8.22.0-r0
8.22.0-r0
curl
Alpine:v3.24
 7.46.0 up to 8.21.0-r0
8.21.0-r0
curl
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
libcurl
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
libcurl-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
libcurl-minimal
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
curl
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.76.1-40.el9_8.7
7.76.1-40.el9_8.7
curl-minimal
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.76.1-40.el9_8.7
7.76.1-40.el9_8.7
libcurl
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.76.1-40.el9_8.7
7.76.1-40.el9_8.7
libcurl-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.76.1-40.el9_8.7
7.76.1-40.el9_8.7
Show 138 moreShow less
Affected packages
PackageAffectedFixed
libcurl-minimal
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.76.1-40.el9_8.7
7.76.1-40.el9_8.7
curl
AlmaLinux:8
From an advisory covering 5 CVEs
 before 7.61.1-34.el8_10.18
7.61.1-34.el8_10.18
libcurl
AlmaLinux:8
From an advisory covering 5 CVEs
 before 7.61.1-34.el8_10.18
7.61.1-34.el8_10.18
libcurl-devel
AlmaLinux:8
From an advisory covering 5 CVEs
 before 7.61.1-34.el8_10.18
7.61.1-34.el8_10.18
libcurl-minimal
AlmaLinux:8
From an advisory covering 5 CVEs
 before 7.61.1-34.el8_10.18
7.61.1-34.el8_10.18
curl
Azure Linux:3
 before 8.11.1-10
8.11.1-10
cmake
Azure Linux:3
 before 3.30.3-15
3.30.3-15
curl
Alpaquita:23
 8.1.0-r2 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:25
 8.14.0-r1 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:stream
 8.1.2-r0 up to 8.21.0-r0
8.21.0-r0
curl
BellSoft Hardened Containers:stream
 8.1.2-r0 up to 8.21.0-r0
8.21.0-r0
curl
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els18
7.76.1-31.el9_6.1.tuxcare.els18
curl-minimal
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els18
7.76.1-31.el9_6.1.tuxcare.els18
libcurl
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els18
7.76.1-31.el9_6.1.tuxcare.els18
libcurl-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els18
7.76.1-31.el9_6.1.tuxcare.els18
libcurl-minimal
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els18
7.76.1-31.el9_6.1.tuxcare.els18
curl
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els18
7.76.1-31.el9_2.1.tuxcare.els18
curl-minimal
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els18
7.76.1-31.el9_2.1.tuxcare.els18
libcurl
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els18
7.76.1-31.el9_2.1.tuxcare.els18
libcurl-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els18
7.76.1-31.el9_2.1.tuxcare.els18
libcurl-minimal
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els18
7.76.1-31.el9_2.1.tuxcare.els18
curl
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 7.68.0-1ubuntu2.25+tuxcare.els6
7.68.0-1ubuntu2.25+tuxcare.els6
libcurl3-gnutls
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 7.68.0-1ubuntu2.25+tuxcare.els6
7.68.0-1ubuntu2.25+tuxcare.els6
libcurl3-nss
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 7.68.0-1ubuntu2.25+tuxcare.els6
7.68.0-1ubuntu2.25+tuxcare.els6
libcurl4
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 7.68.0-1ubuntu2.25+tuxcare.els6
7.68.0-1ubuntu2.25+tuxcare.els6
libcurl4-doc
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 7.68.0-1ubuntu2.25+tuxcare.els6
7.68.0-1ubuntu2.25+tuxcare.els6
libcurl4-gnutls-dev
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 7.68.0-1ubuntu2.25+tuxcare.els6
7.68.0-1ubuntu2.25+tuxcare.els6
libcurl4-nss-dev
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 7.68.0-1ubuntu2.25+tuxcare.els6
7.68.0-1ubuntu2.25+tuxcare.els6
libcurl4-openssl-dev
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 7.68.0-1ubuntu2.25+tuxcare.els6
7.68.0-1ubuntu2.25+tuxcare.els6
curl
TuxCare:Debian:10
 before 7.64.0-4+deb10u9+tuxcare.els7
7.64.0-4+deb10u9+tuxcare.els7
libcurl3-gnutls
TuxCare:Debian:10
 before 7.64.0-4+deb10u9+tuxcare.els7
7.64.0-4+deb10u9+tuxcare.els7
libcurl3-nss
TuxCare:Debian:10
 before 7.64.0-4+deb10u9+tuxcare.els7
7.64.0-4+deb10u9+tuxcare.els7
libcurl4
TuxCare:Debian:10
 before 7.64.0-4+deb10u9+tuxcare.els7
7.64.0-4+deb10u9+tuxcare.els7
libcurl4-doc
TuxCare:Debian:10
 before 7.64.0-4+deb10u9+tuxcare.els7
7.64.0-4+deb10u9+tuxcare.els7
libcurl4-gnutls-dev
TuxCare:Debian:10
 before 7.64.0-4+deb10u9+tuxcare.els7
7.64.0-4+deb10u9+tuxcare.els7
libcurl4-nss-dev
TuxCare:Debian:10
 before 7.64.0-4+deb10u9+tuxcare.els7
7.64.0-4+deb10u9+tuxcare.els7
libcurl4-openssl-dev
TuxCare:Debian:10
 before 7.64.0-4+deb10u9+tuxcare.els7
7.64.0-4+deb10u9+tuxcare.els7
curl
Debian:12
 All versions, plus listed versions
7.88.1-107.88.1-10+deb12u17.88.1-10+deb12u117.88.1-10+deb12u127.88.1-10+deb12u13
Show 45 moreShow less
7.88.1-10+deb12u147.88.1-10+deb12u157.88.1-10+deb12u1~bpo11+17.88.1-10+deb12u27.88.1-10+deb12u37.88.1-10+deb12u3~bpo11+17.88.1-10+deb12u47.88.1-10+deb12u57.88.1-10+deb12u5~bpo11+17.88.1-10+deb12u67.88.1-10+deb12u6~bpo11+17.88.1-10+deb12u77.88.1-10+deb12u87.88.1-10+deb12u97.88.1-118.0.1-1~exp18.10.0-18.10.0-28.10.1-18.10.1-1~bpo12+18.10.1-28.11.0-18.11.1-18.11.1-1~bpo12+18.12.0+git20250209.89ed161+ds-18.12.0+git20250209.89ed161+ds-1~bpo12+18.12.1-18.12.1-28.12.1-2~bpo12+18.12.1-38.12.1-3~bpo12+18.13.0-18.13.0-1+exp18.13.0-28.13.0-2+exp18.13.0-38.13.0-48.13.0-4+exp18.13.0-58.13.0-5+exp18.13.0-5~bpo12+18.13.0~rc-1~exp18.13.0~rc-1~exp28.13.0~rc2-18.13.0~rc2-2
 None known
curl
Debian:13
 All versions, plus listed versions
8.14.1-28.14.1-2+deb13u18.14.1-2+deb13u28.14.1-2+deb13u2~bpo13+18.14.1-2+deb13u3
Show 45 moreShow less
8.14.1-2+deb13u48.14.1-2+deb13u58.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp18.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp
 None known
curl
Debian:14
 before 8.21.0~rc2-1, plus listed versions
8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1
Show 45 moreShow less
8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp8.20.0-28.20.0-2+exp18.20.0-2~bpo13+18.20.0-38.20.0-48.20.0-5
8.21.0~rc2-1
CURL_jll
Julia
 before 8.20.0+0
8.20.0+0
LibCURL_jll
Julia
 before 8.20.0+0
8.20.0+0
curl
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl-devel
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl-minimal
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
cargo
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
clippy
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-analyzer
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-debugger-common
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-doc
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-gdb
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-lldb
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-src
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rustfmt
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
curl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-minimal-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-minimal
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
curl-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
curl-minimal-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
libcurl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
libcurl-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
libcurl-minimal-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
curl
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
curl-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
curl-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
curl-minimal
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
curl-minimal-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
libcurl
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
libcurl-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
libcurl-minimal
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
libcurl-minimal-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
curl-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
curl-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-minimal-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
curl
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-minimal
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
curl
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.7
0:7.76.1-40.el9_8.7
curl
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:7.61.1-34.el8_10.18
0:7.61.1-34.el8_10.18
curl
Root:Debian:11
 before 7.74.0-1.3+deb11u16.aikido.18
7.74.0-1.3+deb11u16.aikido.187.74.0-1.3+deb11u16.aikido.19
rootio-curl
Root:Debian:11
 before 7.74.0-1.3+deb11u16.aikido.18
7.74.0-1.3+deb11u16.aikido.187.74.0-1.3+deb11u16.aikido.19
curl
Root:Debian:12
 before 7.88.1-10+deb12u15.aikido.13
7.88.1-10+deb12u15.aikido.137.88.1-10+deb12u15.aikido.147.88.1-10+deb12u15.aikido.157.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20
rootio-curl
Root:Debian:12
 before 7.88.1-10+deb12u15.aikido.13
7.88.1-10+deb12u15.aikido.137.88.1-10+deb12u15.aikido.147.88.1-10+deb12u15.aikido.157.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20
curl
Root:Debian:13
 before 8.14.1-2+deb13u7.aikido.24
8.14.1-2+deb13u7.aikido.248.14.1-2+deb13u7.aikido.25
rootio-curl
Root:Debian:13
 before 8.14.1-2+deb13u7.aikido.24
8.14.1-2+deb13u7.aikido.248.14.1-2+deb13u7.aikido.25
curl
SUSE:Linux Micro 6.2
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1
curl
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1
curl-mini
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1
curl
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1
curl-mini
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1
curl
SUSE:Linux Micro 6.0
From an advisory covering 10 CVEs
 before 8.14.1-7.1
8.14.1-7.1
curl
SUSE:Linux Micro 6.1
From an advisory covering 10 CVEs
 before 8.14.1-slfo.1.1_8.1
8.14.1-slfo.1.1_8.1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 11 CVEs
 before 8.14.1-150700.7.20.1
8.14.1-150700.7.20.1
curl
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 10 CVEs
 before 8.14.1-150600.4.46.1
8.14.1-150600.4.46.1
curl
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 10 CVEs
 before 8.14.1-150600.4.46.1
8.14.1-150600.4.46.1
curl
SUSE:Linux Enterprise Installer Updates 15 SP4
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Installer Updates 15 SP5
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 6 CVEs
 before 8.0.1-11.126.1
8.0.1-11.126.1
curl
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 6 CVEs
 before 8.0.1-11.126.1
8.0.1-11.126.1
curl
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 13 CVEs
 before 8.0.1-11.134.1
8.0.1-11.134.1
curl
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 13 CVEs
 before 8.0.1-11.134.1
8.0.1-11.134.1
curl
Ubuntu:Pro:18.04:LTS
 before 7.58.0-2ubuntu3.24+esm9, plus listed versions
7.55.1-1ubuntu27.55.1-1ubuntu2.17.57.0-1ubuntu17.58.0-2ubuntu17.58.0-2ubuntu2
Show 30 moreShow less
7.58.0-2ubuntu37.58.0-2ubuntu3.17.58.0-2ubuntu3.27.58.0-2ubuntu3.37.58.0-2ubuntu3.57.58.0-2ubuntu3.67.58.0-2ubuntu3.77.58.0-2ubuntu3.87.58.0-2ubuntu3.97.58.0-2ubuntu3.107.58.0-2ubuntu3.127.58.0-2ubuntu3.137.58.0-2ubuntu3.147.58.0-2ubuntu3.157.58.0-2ubuntu3.167.58.0-2ubuntu3.177.58.0-2ubuntu3.187.58.0-2ubuntu3.197.58.0-2ubuntu3.207.58.0-2ubuntu3.217.58.0-2ubuntu3.227.58.0-2ubuntu3.237.58.0-2ubuntu3.247.58.0-2ubuntu3.24+esm17.58.0-2ubuntu3.24+esm27.58.0-2ubuntu3.24+esm37.58.0-2ubuntu3.24+esm47.58.0-2ubuntu3.24+esm57.58.0-2ubuntu3.24+esm77.58.0-2ubuntu3.24+esm8
7.58.0-2ubuntu3.24+esm9
curl
Ubuntu:Pro:20.04:LTS
 before 7.68.0-1ubuntu2.25+esm4, plus listed versions
7.65.3-1ubuntu37.65.3-1ubuntu47.66.0-1ubuntu17.67.0-2ubuntu17.68.0-1ubuntu1
Show 24 moreShow less
7.68.0-1ubuntu27.68.0-1ubuntu2.17.68.0-1ubuntu2.27.68.0-1ubuntu2.47.68.0-1ubuntu2.57.68.0-1ubuntu2.67.68.0-1ubuntu2.77.68.0-1ubuntu2.107.68.0-1ubuntu2.117.68.0-1ubuntu2.127.68.0-1ubuntu2.137.68.0-1ubuntu2.147.68.0-1ubuntu2.157.68.0-1ubuntu2.167.68.0-1ubuntu2.187.68.0-1ubuntu2.197.68.0-1ubuntu2.207.68.0-1ubuntu2.217.68.0-1ubuntu2.227.68.0-1ubuntu2.237.68.0-1ubuntu2.247.68.0-1ubuntu2.257.68.0-1ubuntu2.25+esm27.68.0-1ubuntu2.25+esm3
7.68.0-1ubuntu2.25+esm4
curl
Ubuntu:22.04:LTS
 before 7.81.0-1ubuntu1.25, plus listed versions
7.74.0-1.3ubuntu27.74.0-1.3ubuntu37.80.0-37.81.0-17.81.0-1ubuntu1.1
Show 20 moreShow less
7.81.0-1ubuntu1.27.81.0-1ubuntu1.37.81.0-1ubuntu1.47.81.0-1ubuntu1.67.81.0-1ubuntu1.77.81.0-1ubuntu1.87.81.0-1ubuntu1.107.81.0-1ubuntu1.117.81.0-1ubuntu1.137.81.0-1ubuntu1.147.81.0-1ubuntu1.157.81.0-1ubuntu1.167.81.0-1ubuntu1.177.81.0-1ubuntu1.187.81.0-1ubuntu1.197.81.0-1ubuntu1.207.81.0-1ubuntu1.217.81.0-1ubuntu1.227.81.0-1ubuntu1.237.81.0-1ubuntu1.24
7.81.0-1ubuntu1.25
curl
Ubuntu:24.04:LTS
 before 8.5.0-2ubuntu10.10, plus listed versions
8.2.1-1ubuntu38.2.1-1ubuntu3.18.4.0-2ubuntu18.5.0-2ubuntu18.5.0-2ubuntu2
Show 12 moreShow less
8.5.0-2ubuntu88.5.0-2ubuntu98.5.0-2ubuntu108.5.0-2ubuntu10.18.5.0-2ubuntu10.28.5.0-2ubuntu10.38.5.0-2ubuntu10.48.5.0-2ubuntu10.58.5.0-2ubuntu10.68.5.0-2ubuntu10.78.5.0-2ubuntu10.88.5.0-2ubuntu10.9
8.5.0-2ubuntu10.10
curl
Ubuntu:25.10
 before 8.14.1-2ubuntu1.4, plus listed versions
8.12.1-3ubuntu18.13.0-5ubuntu18.14.1-1ubuntu28.14.1-1ubuntu38.14.1-2ubuntu18.14.1-2ubuntu1.18.14.1-2ubuntu1.28.14.1-2ubuntu1.3
8.14.1-2ubuntu1.4
curl
Ubuntu:26.04:LTS
 before 8.18.0-1ubuntu2.2, plus listed versions
8.14.1-2ubuntu18.17.0-1ubuntu18.18.0-1ubuntu18.18.0-1ubuntu28.18.0-1ubuntu2.1
8.18.0-1ubuntu2.2
curl
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 8.21.0-1.1
8.21.0-1.1
curl
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1

History

History
RecordedChangedSources
affectedOSV
affectedOSV
affected, aliases, facts, referencesOSV
affectedOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-8458 is a medium vulnerability (CVSS 6.5) in Curl, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in curl 8.22.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 177 versions and 103 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open