CVE-2026-19931
Negotiate ambient user conn reuse
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Negotiate ambient user conn reuse
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
CVE-2026-19931- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-488, CWE-488
- Updated
- 2026-11-02
EUVDEUVD-2026-72166
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
EUVD-2026-72166- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rhw6-3rrg-mwjq
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using...
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
GHSA-rhw6-3rrg-mwjq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-488
- Updated
- 2026-11-02
NVD
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
CVE-2026-19931- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-488
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-19931
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
ALPINE-CVE-2026-19931- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2026-19931
- Record
BELL-CVE-2026-19931- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 30 moreShow less
OSV
Negotiate ambient user conn reuse
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
CVE-2026-19931- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-488
- Updated
- 2026-11-03
OSVDEBIAN-CVE-2026-19931
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
DEBIAN-CVE-2026-19931- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4124
curl security update
cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.
Security Fix(es):
Successfully using libcurl to do a transfer to a specific HTTP origin
(hostA) with Digest authentication and then changing the origin to a
different one (hostB) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the Authorization: header field meant for hostA,
to hostB.(CVE-2026-11856)
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)
When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable
standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and
CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on
connections established without a presented server certificate. Bypassing the
pinning check under these disabled-verification conditions allows
unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup
for a given hostname even when using a different Native CA Store setting
(CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)
When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a Set-Cookie header where the Domain
attribute explicitly matches an origin host that is itself a public suffix
(e.g., Domain=co.uk set by co.uk).
Instead of coercing it into a strict host-only cookie, libcurl saves the
cookie with wildcard domain scope (.co.uk). Consequently, the cookie is
inappropriately included in subsequent outbound requests or HTTP redirects to
arbitrary sibling subdomains under the same public suffix (e.g.,
attacker.co.uk).(CVE-2026-82209)
- Record
OESA-2026-4124- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4125
curl security update
cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.
Security Fix(es):
Successfully using libcurl to do a transfer to a specific HTTP origin
(hostA) with Digest authentication and then changing the origin to a
different one (hostB) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the Authorization: header field meant for hostA,
to hostB.(CVE-2026-11856)
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)
When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable
standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and
CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on
connections established without a presented server certificate. Bypassing the
pinning check under these disabled-verification conditions allows
unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup
for a given hostname even when using a different Native CA Store setting
(CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)
When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a Set-Cookie header where the Domain
attribute explicitly matches an origin host that is itself a public suffix
(e.g., Domain=co.uk set by co.uk).
Instead of coercing it into a strict host-only cookie, libcurl saves the
cookie with wildcard domain scope (.co.uk). Consequently, the cookie is
inappropriately included in subsequent outbound requests or HTTP redirects to
arbitrary sibling subdomains under the same public suffix (e.g.,
attacker.co.uk).(CVE-2026-82209)
- Record
OESA-2026-4125- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4126
curl security update
cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.
Security Fix(es):
Successfully using libcurl to do a transfer to a specific HTTP origin
(hostA) with Digest authentication and then changing the origin to a
different one (hostB) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the Authorization: header field meant for hostA,
to hostB.(CVE-2026-11856)
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)
When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable
standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and
CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on
connections established without a presented server certificate. Bypassing the
pinning check under these disabled-verification conditions allows
unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup
for a given hostname even when using a different Native CA Store setting
(CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)
When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a Set-Cookie header where the Domain
attribute explicitly matches an origin host that is itself a public suffix
(e.g., Domain=co.uk set by co.uk).
Instead of coercing it into a strict host-only cookie, libcurl saves the
cookie with wildcard domain scope (.co.uk). Consequently, the cookie is
inappropriately included in subsequent outbound requests or HTTP redirects to
arbitrary sibling subdomains under the same public suffix (e.g.,
attacker.co.uk).(CVE-2026-82209)
- Record
OESA-2026-4126- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4127
curl security update
cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.
Security Fix(es):
Successfully using libcurl to do a transfer to a specific HTTP origin
(hostA) with Digest authentication and then changing the origin to a
different one (hostB) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the Authorization: header field meant for hostA,
to hostB.(CVE-2026-11856)
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)
When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable
standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and
CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on
connections established without a presented server certificate. Bypassing the
pinning check under these disabled-verification conditions allows
unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup
for a given hostname even when using a different Native CA Store setting
(CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)
When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a Set-Cookie header where the Domain
attribute explicitly matches an origin host that is itself a public suffix
(e.g., Domain=co.uk set by co.uk).
Instead of coercing it into a strict host-only cookie, libcurl saves the
cookie with wildcard domain scope (.co.uk). Consequently, the cookie is
inappropriately included in subsequent outbound requests or HTTP redirects to
arbitrary sibling subdomains under the same public suffix (e.g.,
attacker.co.uk).(CVE-2026-82209)
- Record
OESA-2026-4127- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4128
curl security update
cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.
Security Fix(es):
Successfully using libcurl to do a transfer to a specific HTTP origin
(hostA) with Digest authentication and then changing the origin to a
different one (hostB) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the Authorization: header field meant for hostA,
to hostB.(CVE-2026-11856)
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)
When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable
standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and
CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on
connections established without a presented server certificate. Bypassing the
pinning check under these disabled-verification conditions allows
unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup
for a given hostname even when using a different Native CA Store setting
(CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)
When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a Set-Cookie header where the Domain
attribute explicitly matches an origin host that is itself a public suffix
(e.g., Domain=co.uk set by co.uk).
Instead of coercing it into a strict host-only cookie, libcurl saves the
cookie with wildcard domain scope (.co.uk). Consequently, the cookie is
inappropriately included in subsequent outbound requests or HTTP redirects to
arbitrary sibling subdomains under the same public suffix (e.g.,
attacker.co.uk).(CVE-2026-82209)
- Record
OESA-2026-4128- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:63161
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:63161- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2026:63514
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:63514- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-19931
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
UBUNTU-CVE-2026-19931- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-99752 No score
CVE-2026-19931 affecting package curl for versions less than 8.11.1-12
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
AZL-99752- Updated
- 2026-11-05
OSVAZL-99777 No score
CVE-2026-19931 affecting package cmake 3.30.3-15
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
AZL-99777- Updated
- 2026-11-02
OSVAZL-99792 No score
CVE-2026-19931 affecting package mysql 8.0.46-1
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
AZL-99792- Updated
- 2026-11-02
OSVAZL-99819 No score
CVE-2026-19931 affecting package rust 1.75.0-30
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
AZL-99819- Updated
- 2026-11-02
OSVAZL-99843 No score
CVE-2026-19931 affecting package rust 1.90.0-10
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
AZL-99843- Updated
- 2026-11-02
OSVAZL-99870 No score
CVE-2026-19931 affecting package tensorflow 2.16.1-11
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
AZL-99870- Updated
- 2026-11-02
OSVCURL-CVE-2026-19931 No score
Negotiate ambient user conn reuse
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
- Record
CURL-CVE-2026-19931- Updated
- 2026-11-02
OSVMGASA-2026-0515 No score
Updated curl package fixes security vulnerabilities
curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set cookie erases cookie jar CVE-2026-86413: Negotiate credentials sent to redirected origin CVE-2026-86414: leaking host credentials to HTTP proxy CVE-2026-86415: auto client cert connection reuse mixup CVE-2026-87861: cross-origin reuse of a Negotiate connection CVE-2026-87862: HSTS cache import drops longer-lived child CVE-2026-87863: HSTS response erases persisted entries CVE-2026-92386: server-set cookie aborts cookie jar load CVE-2026-92387: never-ending loop via server response omission CVE-2026-92388: FTP wildcard write callback mixup CVE-2026-92389: TFTP direction confusion CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints CVE-2026-92391: curl_mime_free stack overflow by recursion CVE-2026-92392: HTTP/2 upload Use-After-Free CVE-2026-94265: Authorization: Negotiate sent to foreign origin CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL CVE-2026-107929: local interface connection reuse mixup There were also some CVE IDs released at the same time that were fixed earlier, in 8.22.0, but just announced now: CVE-2026-86409: stale SigV4 headers sent unintended CVE-2026-86411: FTP connection reuse inherits client-certificate CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection Here are the CVEs fixed in 8.22.0, which wasn't released in mga10 and so are only getting fixed now: CVE-2026-13608: OpenLDAP SASL authentication bypass CVE-2026-18924: HTTP/2 server push UAF CVE-2026-19931: Negotiate ambient user conn reuse CVE-2026-80229: OpenSSL provider use-after-free CVE-2026-80230: OpenSSL pinning bypass CVE-2026-80255: secure cookie attribute bypass with tab CVE-2026-82209: domain-scoped PSL domain cookie
- Record
MGASA-2026-0515- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11696-1 No score
curl-8.22.0-1.1 on GA media
These are all security issues fixed in the curl-8.22.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11696-1- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-315-CVE-2026-19931 No score
CVE-2026-19931 in curl - Patched by Root
Root has patched CVE-2026-19931 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-315-CVE-2026-19931- Updated
- 2026-11-04
OSVROOT-OS-ALPINE-317-CVE-2026-19931 No score
CVE-2026-19931 in curl - Patched by Root
Root has patched CVE-2026-19931 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-317-CVE-2026-19931- Updated
- 2026-11-04
OSVROOT-OS-ALPINE-320-CVE-2026-19931 No score
CVE-2026-19931 in curl - Patched by Root
Root has patched CVE-2026-19931 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-320-CVE-2026-19931- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-321-CVE-2026-19931 No score
CVE-2026-19931 in curl - Patched by Root
Root has patched CVE-2026-19931 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-321-CVE-2026-19931- Updated
- 2026-11-03
OSVROOT-OS-ALPINE-322-CVE-2026-19931 No score
CVE-2026-19931 in curl - Patched by Root
Root has patched CVE-2026-19931 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-322-CVE-2026-19931- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-19931 No score
CVE-2026-19931 in curl - Patched by Root
Root has patched CVE-2026-19931 in the curl package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-19931- Updated
- 2026-11-04
OSVROOT-OS-DEBIAN-13-CVE-2026-19931 No score
CVE-2026-19931 in curl - Patched by Root
Root has patched CVE-2026-19931 in the curl package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-19931- Updated
- 2026-11-03
OSVSUSE-SU-2026:4954-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).
- Record
SUSE-SU-2026:4954-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:5068-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-9546: sending old referer (bsc#1268419).
- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
- CVE-2026-11564: Native CA trust persist (bsc#1268424).
- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).
Changes for curl:
- Updated curl to version 8.22.0. (jsc#PED-16984)
- Record
SUSE-SU-2026:5068-1- Updated
- 2026-11-03
OSVSUSE-SU-2026:5069-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-9546: sending old referer (bsc#1268419).
- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
- CVE-2026-11564: Native CA trust persist (bsc#1268424).
- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).
Changes for curl:
- Updated to version 8.22.0. (jsc#PED-16984)
- Record
SUSE-SU-2026:5069-1- Updated
- 2026-11-03
OSVSUSE-SU-2026:5071-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- Record
SUSE-SU-2026:5071-1- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.23 |
7.64.1 up to 8.22.0-r0 | 8.22.0-r0 |
curlAlpine:v3.24 |
7.64.1 up to 8.22.0-r0 | 8.22.0-r0 |
curlAzure Linux:3 |
before 8.11.1-12 | 8.11.1-12 |
cmakeAzure Linux:3 |
through 3.30.3-15 | None known |
mysqlAzure Linux:3 |
through 8.0.46-1 | None known |
rustAzure Linux:3 |
through 1.75.0-30 | None known |
rustAzure Linux:3 |
1.85.0 to 1.90.0-10 | None known |
tensorflowAzure Linux:3 |
through 2.16.1-11 | None known |
curlAlpaquita:23 |
8.1.0-r2 up to 8.22.0-r0 | 8.22.0-r0 |
curlAlpaquita:25 |
8.14.0-r1 up to 8.22.0-r0 | 8.22.0-r0 |
Show 65 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlAlpaquita:stream |
8.1.2-r0 up to 8.22.0-r0 | 8.22.0-r0 |
curlBellSoft Hardened Containers:stream |
8.1.2-r0 up to 8.22.0-r0 | 8.22.0-r0 |
curlDebian:12 |
All versions, plus listed versions 7.88.1-107.88.1-10+deb12u17.88.1-10+deb12u117.88.1-10+deb12u127.88.1-10+deb12u13 Show 45 moreShow less7.88.1-10+deb12u147.88.1-10+deb12u157.88.1-10+deb12u1~bpo11+17.88.1-10+deb12u27.88.1-10+deb12u37.88.1-10+deb12u3~bpo11+17.88.1-10+deb12u47.88.1-10+deb12u57.88.1-10+deb12u5~bpo11+17.88.1-10+deb12u67.88.1-10+deb12u6~bpo11+17.88.1-10+deb12u77.88.1-10+deb12u87.88.1-10+deb12u97.88.1-118.0.1-1~exp18.10.0-18.10.0-28.10.1-18.10.1-1~bpo12+18.10.1-28.11.0-18.11.1-18.11.1-1~bpo12+18.12.0+git20250209.89ed161+ds-18.12.0+git20250209.89ed161+ds-1~bpo12+18.12.1-18.12.1-28.12.1-2~bpo12+18.12.1-38.12.1-3~bpo12+18.13.0-18.13.0-1+exp18.13.0-28.13.0-2+exp18.13.0-38.13.0-48.13.0-4+exp18.13.0-58.13.0-5+exp18.13.0-5~bpo12+18.13.0~rc-1~exp18.13.0~rc-1~exp28.13.0~rc2-18.13.0~rc2-2 |
None known |
curlDebian:13 |
All versions, plus listed versions 8.14.1-28.14.1-2+deb13u18.14.1-2+deb13u28.14.1-2+deb13u2~bpo13+18.14.1-2+deb13u3 Show 45 moreShow less8.14.1-2+deb13u48.14.1-2+deb13u58.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp18.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp |
None known |
curlDebian:14 |
before 8.22.0~rc2-1, plus listed versions 8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1 Show 45 moreShow less8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp8.20.0-28.20.0-2+exp18.20.0-2~bpo13+18.20.0-38.20.0-48.20.0-5 |
8.22.0~rc2-1 |
curlMageia:10 From an advisory covering 31 CVEs |
before 8.23.0-1.mga10 | 8.23.0-1.mga10 |
curlopenEuler:20.03-LTS-SP4 From an advisory covering 6 CVEs |
before 7.71.1-54.oe2003sp4 | 7.71.1-54.oe2003sp4 |
curlopenEuler:22.03-LTS-SP4 From an advisory covering 6 CVEs |
before 7.79.1-56.oe2203sp4 | 7.79.1-56.oe2203sp4 |
curlopenEuler:24.03-LTS-SP1 From an advisory covering 7 CVEs |
before 8.4.0-37.oe2403sp1 | 8.4.0-37.oe2403sp1 |
curlopenEuler:24.03-LTS-SP3 From an advisory covering 7 CVEs |
before 8.4.0-37.oe2403sp3 | 8.4.0-37.oe2403sp3 |
curlopenEuler:24.03-LTS-SP4 From an advisory covering 7 CVEs |
before 8.4.0-37.oe2403sp4 | 8.4.0-37.oe2403sp4 |
curlRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:8.22.0-0.1.hum1 | 0:8.22.0-0.1.hum1 |
libcurlRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:8.22.0-0.1.hum1 | 0:8.22.0-0.1.hum1 |
libcurl-develRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:8.22.0-0.1.hum1 | 0:8.22.0-0.1.hum1 |
libcurl-minimalRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:8.22.0-0.1.hum1 | 0:8.22.0-0.1.hum1 |
cargoRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
clippyRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rustRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-analyzerRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-debugger-commonRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-docRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-gdbRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-lldbRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-srcRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-std-staticRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-std-static-aarch64-unknown-none-softfloatRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-std-static-aarch64-unknown-uefiRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-std-static-i686-pc-windows-gnuRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-std-static-wasm32-unknown-unknownRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-std-static-wasm32-wasip1Red Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-std-static-x86_64-pc-windows-gnuRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-std-static-x86_64-unknown-noneRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rust-std-static-x86_64-unknown-uefiRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
rustfmtRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.98.0-1.hum1 | 0:1.98.0-1.hum1 |
curlRoot:Alpine:3.15 |
before 8.5.0-r00073 | 8.5.0-r000738.5.0-r000748.5.0-r00075 |
rootio-curlRoot:Alpine:3.15 |
before 8.5.0-r00073 | 8.5.0-r000738.5.0-r000748.5.0-r00075 |
curlRoot:Alpine:3.17 |
before 8.9.0-r00072 | 8.9.0-r000728.9.0-r000738.9.0-r000748.9.0-r000758.9.0-r000768.9.0-r00077 |
rootio-curlRoot:Alpine:3.17 |
before 8.9.0-r00072 | 8.9.0-r000728.9.0-r000738.9.0-r000748.9.0-r000758.9.0-r000768.9.0-r00077 |
curlRoot:Alpine:3.20 |
before 8.14.1-r200711 | 8.14.1-r2007118.14.1-r200712 |
rootio-curlRoot:Alpine:3.20 |
before 8.14.1-r200711 | 8.14.1-r2007118.14.1-r200712 |
curlRoot:Alpine:3.21 |
before 8.14.1-r30078 | 8.14.1-r300788.14.1-r200758.14.1-r200768.14.1-r200778.14.1-r300798.14.1-r3007108.14.1-r3007118.14.1-r300712 |
rootio-curlRoot:Alpine:3.21 |
before 8.14.1-r30078 | 8.14.1-r300788.14.1-r200758.14.1-r200768.14.1-r200778.14.1-r300798.14.1-r3007108.14.1-r3007118.14.1-r300712 |
curlRoot:Alpine:3.22 |
before 8.14.1-r400710 | 8.14.1-r4007108.14.1-r300758.14.1-r300768.14.1-r300778.14.1-r300788.14.1-r30079 |
rootio-curlRoot:Alpine:3.22 |
before 8.14.1-r400710 | 8.14.1-r4007108.14.1-r300758.14.1-r300768.14.1-r300778.14.1-r300788.14.1-r30079 |
curlRoot:Debian:12 |
before 7.88.1-10+deb12u15.aikido.16 | 7.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20 |
rootio-curlRoot:Debian:12 |
before 7.88.1-10+deb12u15.aikido.16 | 7.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20 |
curlRoot:Debian:13 |
before 8.14.1-2+deb13u7.aikido.24 | 8.14.1-2+deb13u7.aikido.248.14.1-2+deb13u7.aikido.25 |
rootio-curlRoot:Debian:13 |
before 8.14.1-2+deb13u7.aikido.24 | 8.14.1-2+deb13u7.aikido.248.14.1-2+deb13u7.aikido.25 |
curlSUSE:Linux Enterprise Installer Updates 15 SP4 From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise Installer Updates 15 SP5 From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise Micro 5.3 From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise Micro 5.4 From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise Micro 5.5 From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 21 CVEs |
before 8.14.1-150400.5.98.1 | 8.14.1-150400.5.98.1 |
curlSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 31 CVEs |
before 8.22.0-150700.7.33.1 | 8.22.0-150700.7.33.1 |
curlSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 31 CVEs |
before 8.22.0-150600.4.58.1 | 8.22.0-150600.4.58.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 31 CVEs |
before 8.22.0-150600.4.58.1 | 8.22.0-150600.4.58.1 |
curlSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 13 CVEs |
before 8.0.1-11.134.1 | 8.0.1-11.134.1 |
curlSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 13 CVEs |
before 8.0.1-11.134.1 | 8.0.1-11.134.1 |
curlopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 8.22.0-1.1 | 8.22.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | OSV | |
| affected | OSV | |
| affected | OSV | |
| affected, aliases | OSV | |
| affected | OSV | |
| affected, aliases, facts, references | OSV | |
| affected | OSV | |
| affected | OSV | |
| affected | OSV | |
| affected | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19931 is a critical vulnerability (CVSS 9.8) in Curl, published September 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in curl 8.22.0-r0.
References
curl.se/docs/CVE-2026-19931.json
hackerone.com/reports/3923520
nvd.nist.gov/vuln/detail/CVE-2026-19931
github.com/advisories/GHSA-rhw6-3rrg-mwjq
security.alpinelinux.org/vuln/CVE-2026-19931
Show 144 moreShow less
docs.bell-sw.com/security/cves/CVE-2026-19931
security-tracker.debian.org/tracker/CVE-2026-19931
advisories.mageia.org/MGASA-2026-0515.html
bugs.mageia.org/show_bug.cgi?id=36250
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4124
access.redhat.com/errata/RHSA-2026:63161
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63161.json
bugzilla.redhat.com/show_bug.cgi?id=2529198
cve.org/CVERecord?id=CVE-2026-13608
suse.com/support/update/announcement/2026/suse-su-20264954-1
bugzilla.suse.com/1268414
ubuntu.com/security/CVE-2026-19931
Left out here: 186 versions. The JSON record has them.