Every CVE Search/ Get API key

CVE-2026-8926

password leak with netrc and user in URL

9.1 CriticalFix available

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.44%Up 0.2 points since Jul 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

password leak with netrc and user in URL

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
CVE-2026-8926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-522
Updated
2026-11-02
EUVDEUVD-2026-41507 9.1

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
EUVD-2026-41507
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vw2x-3w8j-rq82 9.1

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL...

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
GHSA-vw2x-3w8j-rq82
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-522
Updated
2026-11-02
NVD 9.1

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
CVE-2026-8926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-522
Updated
2026-11-02
OSVALPINE-CVE-2026-8926 9.1

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
ALPINE-CVE-2026-8926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-8926 9.1
Record
BELL-CVE-2026-8926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 31 moreShow less
OSV 9.1

password leak with netrc and user in URL

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
CVE-2026-8926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-522
Updated
2026-11-02
OSVDEBIAN-CVE-2026-8926 9.1

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
DEBIAN-CVE-2026-8926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVJLSEC-2026-1215 9.1

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL...

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
JLSEC-2026-1215
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-3170 4.8

curl security update

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like `https://(CVE-2026-8926)

Record
OESA-2026-3170
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-3171 4.8

curl security update

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like `https://(CVE-2026-8926)

Record
OESA-2026-3171
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-3172 4.8

curl security update

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like `https://(CVE-2026-8926)

Record
OESA-2026-3172
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:29017 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:29017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:34975 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:34975
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:69125 8.1

Red Hat Security Advisory: curl security update

Record
RHSA-2026:69125
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:72506 8.1

Red Hat Security Advisory: curl security update

Record
RHSA-2026:72506
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:69125 8.1

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

  • curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

  • libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69125
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-8926 9.1

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
UBUNTU-CVE-2026-8926
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:69125 No score

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
  • curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)
  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
  • libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69125
Updated
2026-11-02
OSVAZL-91821 No score

CVE-2026-8926 affecting package curl for versions less than 8.11.1-10

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
AZL-91821
Updated
2026-11-05
OSVCLSA-2026-1786091577 No score

curl: Fix of 2 CVEs

  • CVE-2026-8458: tie the requested SASL/SPNEGO service name to the connection and compare it when matching an existing connection for reuse, so a Negotiate authenticated connection is not reused for a transfer that asked for a different service
  • CVE-2026-8926: discard a .netrc entry that matches the host but whose login does not match the user given in the URL, so the password that belongs to another user of that host is no longer returned as a successful lookup
Record
CLSA-2026-1786091577
Updated
2026-11-02
OSVCLSA-2026-1786094315 No score

curl: Fix of 2 CVEs

  • CVE-2026-8458: tie the requested SASL/SPNEGO service name to the connection and compare it when matching an existing connection for reuse, so a Negotiate authenticated connection is not reused for a transfer that asked for a different service
  • CVE-2026-8926: discard a .netrc entry that matches the host but whose login does not match the user given in the URL, so the password that belongs to another user of that host is no longer returned as a successful lookup
Record
CLSA-2026-1786094315
Updated
2026-11-02
OSVCURL-CVE-2026-8926 No score

password leak with netrc and user in URL

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Record
CURL-CVE-2026-8926
Updated
2026-11-02
OSVopenSUSE-SU-2026:11230-1 No score

curl-8.21.0-1.1 on GA media

These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11230-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21774-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
  • CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
  • CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
  • CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
  • CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
  • CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).
Record
openSUSE-SU-2026:21774-1
Updated
2026-11-02
OSVROOT-OS-ALPINE-320-CVE-2026-8926 No score

CVE-2026-8926 in curl - Patched by Root

Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-320-CVE-2026-8926
Updated
2026-11-02
OSVROOT-OS-ALPINE-321-CVE-2026-8926 No score

CVE-2026-8926 in curl - Patched by Root

Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-321-CVE-2026-8926
Updated
2026-11-03
OSVROOT-OS-ALPINE-322-CVE-2026-8926 No score

CVE-2026-8926 in curl - Patched by Root

Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-322-CVE-2026-8926
Updated
2026-11-02
OSVROOT-OS-ALPINE-323-CVE-2026-8926 No score

CVE-2026-8926 in curl - Patched by Root

Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-323-CVE-2026-8926
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-8926 No score

CVE-2026-8926 in curl - Patched by Root

Root has patched CVE-2026-8926 in the curl package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-8926
Updated
2026-11-03
OSVSUSE-SU-2026:23350-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
  • CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
  • CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).

Changes for curl:

  • Call http_size() first to prioritize Transfer-Encoding: chunked over a zero Content-Length empty body check (bsc#1264971)
Record
SUSE-SU-2026:23350-1
Updated
2026-11-02
OSVSUSE-SU-2026:23361-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
  • CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
  • CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).

Changes for curl:

  • Call http_size() first to prioritize Transfer-Encoding: chunked over a zero Content-Length empty body check (bsc#1264971)
Record
SUSE-SU-2026:23361-1
Updated
2026-11-02
OSVSUSE-SU-2026:23498-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
  • CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
  • CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
  • CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
  • CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
  • CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).
Record
SUSE-SU-2026:23498-1
Updated
2026-11-02
OSVSUSE-SU-2026:23638-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
  • CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
  • CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
  • CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
  • CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
  • CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).
Record
SUSE-SU-2026:23638-1
Updated
2026-11-02
OSVSUSE-SU-2026:3798-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).
  • CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
  • CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).
  • CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).
  • CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).
  • CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
  • CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
Record
SUSE-SU-2026:3798-1
Updated
2026-11-02
OSVSUSE-SU-2026:3958-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
  • CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
  • CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
  • CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
  • CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
  • CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Changes for curl:

  • Call http_size() first to prioritize Transfer-Encoding: chunked over a zero Content-Length empty body check (bsc#1264971)
Record
SUSE-SU-2026:3958-1
Updated
2026-11-02
OSVSUSE-SU-2026:4047-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
  • CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
  • CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
  • CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
  • CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
  • CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Changes for curl:

  • Call http_size() first to prioritize Transfer-Encoding: chunked over a zero Content-Length empty body check (bsc#1264971)
Record
SUSE-SU-2026:4047-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.23
 8.11.1 up to 8.22.0-r0
8.22.0-r0
curl
Alpine:v3.24
 8.11.1 up to 8.21.0-r0
8.21.0-r0
curl
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
libcurl
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
libcurl-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
libcurl-minimal
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
curl
Azure Linux:3
 before 8.11.1-10
8.11.1-10
curl
Alpaquita:23
 8.1.0-r2 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:25
 8.14.0-r1 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:stream
 8.1.2-r0 up to 8.21.0-r0
8.21.0-r0
Show 83 moreShow less
Affected packages
PackageAffectedFixed
curl
BellSoft Hardened Containers:stream
 8.1.2-r0 up to 8.21.0-r0
8.21.0-r0
curl
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els18
7.76.1-31.el9_6.1.tuxcare.els18
curl-minimal
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els18
7.76.1-31.el9_6.1.tuxcare.els18
libcurl
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els18
7.76.1-31.el9_6.1.tuxcare.els18
libcurl-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els18
7.76.1-31.el9_6.1.tuxcare.els18
libcurl-minimal
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els18
7.76.1-31.el9_6.1.tuxcare.els18
curl
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els18
7.76.1-31.el9_2.1.tuxcare.els18
curl-minimal
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els18
7.76.1-31.el9_2.1.tuxcare.els18
libcurl
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els18
7.76.1-31.el9_2.1.tuxcare.els18
libcurl-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els18
7.76.1-31.el9_2.1.tuxcare.els18
libcurl-minimal
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els18
7.76.1-31.el9_2.1.tuxcare.els18
curl
Debian:13
 All versions, plus listed versions
8.14.1-28.14.1-2+deb13u18.14.1-2+deb13u28.14.1-2+deb13u2~bpo13+18.14.1-2+deb13u3
Show 45 moreShow less
8.14.1-2+deb13u48.14.1-2+deb13u58.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp18.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp
 None known
curl
Debian:14
 before 8.21.0~rc2-1, plus listed versions
8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1
Show 45 moreShow less
8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp8.20.0-28.20.0-2+exp18.20.0-2~bpo13+18.20.0-38.20.0-48.20.0-5
8.21.0~rc2-1
CURL_jll
Julia
 8.11.1+0 up to 8.21.0+0
8.21.0+0
LibCURL_jll
Julia
 8.11.1+0 up to 8.21.0+0
8.21.0+0
curl
openEuler:24.03-LTS-SP4
 before 8.4.0-33.oe2403sp4
8.4.0-33.oe2403sp4
curl
openEuler:24.03-LTS-SP1
 before 8.4.0-33.oe2403sp1
8.4.0-33.oe2403sp1
curl
openEuler:24.03-LTS-SP3
 before 8.4.0-33.oe2403sp3
8.4.0-33.oe2403sp3
curl
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl-devel
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl-minimal
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
cargo
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
clippy
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-analyzer
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-debugger-common
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-doc
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-gdb
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-lldb
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-src
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rustfmt
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
curl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-minimal-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-minimal
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
curl-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-minimal-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
curl
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-minimal
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
curl
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl
Root:Alpine:3.20
 before 8.14.1-r20073
8.14.1-r200738.14.1-r200748.14.1-r200758.14.1-r200768.14.1-r200778.14.1-r200788.14.1-r200798.14.1-r2007108.14.1-r2007118.14.1-r200712
rootio-curl
Root:Alpine:3.20
 before 8.14.1-r20073
8.14.1-r200738.14.1-r200748.14.1-r200758.14.1-r200768.14.1-r200778.14.1-r200788.14.1-r200798.14.1-r2007108.14.1-r2007118.14.1-r200712
curl
Root:Alpine:3.21
 before 8.14.1-r20072
8.14.1-r200728.14.1-r200738.14.1-r300788.14.1-r200748.14.1-r200758.14.1-r200768.14.1-r200778.14.1-r300798.14.1-r3007108.14.1-r3007118.14.1-r300712
rootio-curl
Root:Alpine:3.21
 before 8.14.1-r20072
8.14.1-r200728.14.1-r200738.14.1-r300788.14.1-r200748.14.1-r200758.14.1-r200768.14.1-r200778.14.1-r300798.14.1-r3007108.14.1-r3007118.14.1-r300712
curl
Root:Alpine:3.22
 before 8.14.1-r20072
8.14.1-r200728.14.1-r200718.14.1-r200738.14.1-r200748.14.1-r4007108.14.1-r300758.14.1-r300768.14.1-r300778.14.1-r300788.14.1-r30079
rootio-curl
Root:Alpine:3.22
 before 8.14.1-r20072
8.14.1-r200728.14.1-r200718.14.1-r200738.14.1-r200748.14.1-r4007108.14.1-r300758.14.1-r300768.14.1-r300778.14.1-r300788.14.1-r30079
curl
Root:Debian:13
 before 8.14.1-2+deb13u7.aikido.24
8.14.1-2+deb13u7.aikido.248.14.1-2+deb13u7.aikido.25
rootio-curl
Root:Debian:13
 before 8.14.1-2+deb13u7.aikido.24
8.14.1-2+deb13u7.aikido.248.14.1-2+deb13u7.aikido.25
curl
SUSE:Linux Micro 6.1
From an advisory covering 3 CVEs
 before 8.14.1-slfo.1.1_9.1
8.14.1-slfo.1.1_9.1
curl
SUSE:Linux Micro 6.0
From an advisory covering 3 CVEs
 before 8.14.1-8.1
8.14.1-8.1
curl
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 8.14.1-160000.9.1
8.14.1-160000.9.1
curl
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 8.14.1-160000.9.1
8.14.1-160000.9.1
curl-mini
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 8.14.1-160000.9.1
8.14.1-160000.9.1
curl
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 8.14.1-160000.9.1
8.14.1-160000.9.1
curl-mini
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 8.14.1-160000.9.1
8.14.1-160000.9.1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 8.14.1-150700.7.23.1
8.14.1-150700.7.23.1
curl
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 6 CVEs
 before 8.14.1-150400.5.91.1
8.14.1-150400.5.91.1
curl
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 6 CVEs
 before 8.14.1-150400.5.91.1
8.14.1-150400.5.91.1
curl
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 6 CVEs
 before 8.14.1-150400.5.91.1
8.14.1-150400.5.91.1
curl
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 6 CVEs
 before 8.14.1-150600.4.51.1
8.14.1-150600.4.51.1
curl
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 6 CVEs
 before 8.14.1-150600.4.51.1
8.14.1-150600.4.51.1
curl
Ubuntu:25.10
 before 8.14.1-2ubuntu1.4, plus listed versions
8.12.1-3ubuntu18.13.0-5ubuntu18.14.1-1ubuntu28.14.1-1ubuntu38.14.1-2ubuntu18.14.1-2ubuntu1.18.14.1-2ubuntu1.28.14.1-2ubuntu1.3
8.14.1-2ubuntu1.4
curl
Ubuntu:26.04:LTS
 before 8.18.0-1ubuntu2.2, plus listed versions
8.14.1-2ubuntu18.17.0-1ubuntu18.18.0-1ubuntu18.18.0-1ubuntu28.18.0-1ubuntu2.1
8.18.0-1ubuntu2.2
curl
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 8.21.0-1.1
8.21.0-1.1
curl
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 8.14.1-160000.9.1
8.14.1-160000.9.1

History

History
RecordedChangedSources
affected
factsOSV
affectedOSV
affectedOSV
affectedOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-8926 is a critical vulnerability (CVSS 9.1) in Curl, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in curl 8.22.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 43 versions and 80 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open