Every CVE Search/ Get API key

CVE-2026-8924

trailing dot domain super cookie

9.1 CriticalFix available

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.66%Up 0.4 points since Jul 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

trailing dot domain super cookie

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
CVE-2026-8924
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-201
Updated
2026-11-02
EUVDEUVD-2026-41505 9.1

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
EUVD-2026-41505
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hm6c-rc5h-32m9 9.1

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that...

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
GHSA-hm6c-rc5h-32m9
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-201
Updated
2026-11-02
NVD 9.1

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
CVE-2026-8924
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-201
Updated
2026-11-02
OSVALPINE-CVE-2026-8924 9.1

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
ALPINE-CVE-2026-8924
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-8924 9.1
Record
BELL-CVE-2026-8924
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 45 moreShow less
OSV 9.1

trailing dot domain super cookie

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
CVE-2026-8924
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-201
Updated
2026-11-02
OSVDEBIAN-CVE-2026-8924 9.1

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
DEBIAN-CVE-2026-8924
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVJLSEC-2026-1213 9.1

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that...

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
JLSEC-2026-1213
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2984 8.1

curl security update

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

Record
OESA-2026-2984
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2985 8.1

curl security update

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

Record
OESA-2026-2985
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2986 8.1

curl security update

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.(CVE-2026-10536)

When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.(CVE-2026-12064)

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

Record
OESA-2026-2986
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2987 8.1

curl security update

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.(CVE-2026-10536)

When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.(CVE-2026-12064)

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

Record
OESA-2026-2987
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2988 8.1

curl security update

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.(CVE-2026-10536)

When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.(CVE-2026-12064)

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

Record
OESA-2026-2988
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:29017 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:29017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:34975 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:34975
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:69125 8.1

Red Hat Security Advisory: curl security update

Record
RHSA-2026:69125
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:72506 8.1

Red Hat Security Advisory: curl security update

Record
RHSA-2026:72506
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:80511 6.5

Red Hat Security Advisory: curl security update

Record
RHSA-2026:80511
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:69125 8.1

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

  • curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

  • libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69125
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:80511 6.5

Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80511
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:92368 8.1

Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

  • curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

  • Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to Rocky Linux 8 libcurl (JIRA:Rocky Linux-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92368
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-8924 9.1

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
UBUNTU-CVE-2026-8924
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:69125 No score

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
  • curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)
  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
  • libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69125
Updated
2026-11-02
OSVALSA-2026:80511 No score

Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80511
Updated
2026-11-02
OSVALSA-2026:92368 No score

Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
  • curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
  • curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
  • curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

  • Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to AlmaLinux 8 libcurl (JIRA:RHEL-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92368
Updated
2026-11-02
OSVAZL-91845 No score

CVE-2026-8924 affecting package cmake for versions less than 3.30.3-15

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
AZL-91845
Updated
2026-11-05
OSVCLSA-2026-1783341627 No score

Fix CVE(s): CVE-2026-8286, CVE-2026-8924, CVE-2026-8927

  • SECURITY UPDATE: libcurl could reuse a connection for a STARTTLS transfer despite a mismatched TLS configuration.
    • debian/patches/CVE-2026-8286.patch: add an SSL-config match check before reusing a connection for a clear-text protocol that requests TLS, in lib/url.c.
    • CVE-2026-8286
  • SECURITY UPDATE: a trailing-dot cookie domain could bypass the Public Suffix List check and set a super-cookie.
    • debian/patches/CVE-2026-8924.patch: trim trailing dots from the domains before the PSL check in lib/cookie.c.
    • CVE-2026-8924
  • SECURITY UPDATE: libcurl could send proxy Digest credentials to the wrong proxy when the proxy is selected from environment variables on a reused handle.
    • debian/patches/CVE-2026-8927.patch: clear the proxy Digest state when the environment proxy changes, in lib/url.c and lib/urldata.h.
    • CVE-2026-8927
Record
CLSA-2026-1783341627
Updated
2026-11-02
OSVCLSA-2026-1785564870 No score

curl: Fix of 4 CVEs

  • CVE-2026-4873: do not reuse a clear-text STARTTLS connection when the new transfer requires TLS, so an IMAP, SMTP or POP3 request that mandates TLS is not sent over an unencrypted connection
  • CVE-2026-6253: restore the proxy credentials set via options on every redirect so credentials belonging to the first proxy are not disclosed to a second, different proxy
  • CVE-2026-6429: drop credentials that were not set through CURLOPT_USERNAME on redirect so a netrc password established for the first host is not sent to the redirect target over a reused connection or proxy
  • CVE-2026-8924: trim trailing dots from the request and cookie domains before the public suffix list check so a trailing-dot domain cannot set a super cookie scoped to an unrelated site
Record
CLSA-2026-1785564870
Updated
2026-11-02
OSVCLSA-2026-1785847606 No score

curl: Fix of 4 CVEs

  • CVE-2026-4873: do not reuse a clear-text STARTTLS connection when the new transfer requires TLS, so an IMAP, SMTP or POP3 request that mandates TLS is not sent over an unencrypted connection
  • CVE-2026-6253: restore the proxy credentials set via options on every redirect so credentials belonging to the first proxy are not disclosed to a second, different proxy
  • CVE-2026-6429: drop credentials that were not set through CURLOPT_USERNAME on redirect so a netrc password established for the first host is not sent to the redirect target over a reused connection or proxy
  • CVE-2026-8924: trim trailing dots from the request and cookie domains before the public suffix list check so a trailing-dot domain cannot set a super cookie scoped to an unrelated site
Record
CLSA-2026-1785847606
Updated
2026-11-02
OSVCURL-CVE-2026-8924 No score

trailing dot domain super cookie

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Record
CURL-CVE-2026-8924
Updated
2026-11-02
OSVopenSUSE-SU-2026:11230-1 No score

curl-8.21.0-1.1 on GA media

These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11230-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11266-1 No score

libpsl-devel-0.23.0-1.1 on GA media

These are all security issues fixed in the libpsl-devel-0.23.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11266-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21272-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
openSUSE-SU-2026:21272-1
Updated
2026-11-02
OSVROOT-OS-ALPINE-315-CVE-2026-8924 No score

CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-315-CVE-2026-8924
Updated
2026-11-04
OSVROOT-OS-ALPINE-317-CVE-2026-8924 No score

CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-317-CVE-2026-8924
Updated
2026-11-04
OSVROOT-OS-ALPINE-320-CVE-2026-8924 No score

CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-320-CVE-2026-8924
Updated
2026-11-02
OSVROOT-OS-ALPINE-321-CVE-2026-8924 No score

CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-321-CVE-2026-8924
Updated
2026-11-02
OSVROOT-OS-ALPINE-322-CVE-2026-8924 No score

CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-322-CVE-2026-8924
Updated
2026-11-02
OSVROOT-OS-ALPINE-323-CVE-2026-8924 No score

CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-323-CVE-2026-8924
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-8924 No score

CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-8924
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-8924 No score

CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-8924
Updated
2026-11-04
OSVROOT-OS-DEBIAN-13-CVE-2026-8924 No score

CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-8924
Updated
2026-11-02
OSVSUSE-SU-2026:22553-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:22553-1
Updated
2026-11-02
OSVSUSE-SU-2026:22582-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:22582-1
Updated
2026-11-02
OSVSUSE-SU-2026:22709-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:22709-1
Updated
2026-11-02
OSVSUSE-SU-2026:22889-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:22889-1
Updated
2026-11-02
OSVSUSE-SU-2026:2925-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).
  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:2925-1
Updated
2026-11-02
OSVSUSE-SU-2026:2926-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:2926-1
Updated
2026-11-02
OSVSUSE-SU-2026:3043-1 No score

Security update for curl

This update for curl fixes the following issues

  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
  • CVE-2026-9079: stale proxy password leak (bsc#1268415).
  • CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
  • CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Record
SUSE-SU-2026:3043-1
Updated
2026-11-02
OSVSUSE-SU-2026:3814-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
  • CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
  • CVE-2026-8458: wrong reuse for different services (bsc#1268407).
  • CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
  • CVE-2026-9547: SSH improper host validation (bsc#1268420).
  • CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
Record
SUSE-SU-2026:3814-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.21
 7.46.0 up to 8.14.1-r3
8.14.1-r3
curl
Alpine:v3.22
 7.46.0 up to 8.14.1-r4
8.14.1-r4
curl
Alpine:v3.23
 7.46.0 up to 8.22.0-r0
8.22.0-r0
curl
Alpine:v3.24
 7.46.0 up to 8.21.0-r0
8.21.0-r0
curl
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
libcurl
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
libcurl-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
libcurl-minimal
AlmaLinux:10
From an advisory covering 6 CVEs
 before 8.12.1-4.el10_2.6
8.12.1-4.el10_2.6
curl
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.76.1-40.el9_8.8
7.76.1-40.el9_8.8
curl-minimal
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.76.1-40.el9_8.8
7.76.1-40.el9_8.8
Show 144 moreShow less
Affected packages
PackageAffectedFixed
libcurl
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.76.1-40.el9_8.8
7.76.1-40.el9_8.8
libcurl-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.76.1-40.el9_8.8
7.76.1-40.el9_8.8
libcurl-minimal
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.76.1-40.el9_8.8
7.76.1-40.el9_8.8
curl
AlmaLinux:8
From an advisory covering 5 CVEs
 before 7.61.1-34.el8_10.18
7.61.1-34.el8_10.18
libcurl
AlmaLinux:8
From an advisory covering 5 CVEs
 before 7.61.1-34.el8_10.18
7.61.1-34.el8_10.18
libcurl-devel
AlmaLinux:8
From an advisory covering 5 CVEs
 before 7.61.1-34.el8_10.18
7.61.1-34.el8_10.18
libcurl-minimal
AlmaLinux:8
From an advisory covering 5 CVEs
 before 7.61.1-34.el8_10.18
7.61.1-34.el8_10.18
cmake
Azure Linux:3
 before 3.30.3-15
3.30.3-15
curl
Alpaquita:23
 8.1.0-r2 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:25
 8.14.0-r1 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:stream
 8.1.2-r0 up to 8.21.0-r0
8.21.0-r0
curl
BellSoft Hardened Containers:stream
 8.1.2-r0 up to 8.21.0-r0
8.21.0-r0
curl
TuxCare:Ubuntu:16.04
From an advisory covering 3 CVEs
 before 7.47.0-1ubuntu2.23+tuxcare.els15
7.47.0-1ubuntu2.23+tuxcare.els15
libcurl3
TuxCare:Ubuntu:16.04
From an advisory covering 3 CVEs
 before 7.47.0-1ubuntu2.23+tuxcare.els15
7.47.0-1ubuntu2.23+tuxcare.els15
libcurl3-gnutls
TuxCare:Ubuntu:16.04
From an advisory covering 3 CVEs
 before 7.47.0-1ubuntu2.23+tuxcare.els15
7.47.0-1ubuntu2.23+tuxcare.els15
libcurl3-nss
TuxCare:Ubuntu:16.04
From an advisory covering 3 CVEs
 before 7.47.0-1ubuntu2.23+tuxcare.els15
7.47.0-1ubuntu2.23+tuxcare.els15
libcurl4-doc
TuxCare:Ubuntu:16.04
From an advisory covering 3 CVEs
 before 7.47.0-1ubuntu2.23+tuxcare.els15
7.47.0-1ubuntu2.23+tuxcare.els15
libcurl4-gnutls-dev
TuxCare:Ubuntu:16.04
From an advisory covering 3 CVEs
 before 7.47.0-1ubuntu2.23+tuxcare.els15
7.47.0-1ubuntu2.23+tuxcare.els15
libcurl4-nss-dev
TuxCare:Ubuntu:16.04
From an advisory covering 3 CVEs
 before 7.47.0-1ubuntu2.23+tuxcare.els15
7.47.0-1ubuntu2.23+tuxcare.els15
libcurl4-openssl-dev
TuxCare:Ubuntu:16.04
From an advisory covering 3 CVEs
 before 7.47.0-1ubuntu2.23+tuxcare.els15
7.47.0-1ubuntu2.23+tuxcare.els15
curl
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els16
7.76.1-31.el9_6.1.tuxcare.els16
curl-minimal
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els16
7.76.1-31.el9_6.1.tuxcare.els16
libcurl
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els16
7.76.1-31.el9_6.1.tuxcare.els16
libcurl-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els16
7.76.1-31.el9_6.1.tuxcare.els16
libcurl-minimal
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 7.76.1-31.el9_6.1.tuxcare.els16
7.76.1-31.el9_6.1.tuxcare.els16
curl
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els16
7.76.1-31.el9_2.1.tuxcare.els16
curl-minimal
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els16
7.76.1-31.el9_2.1.tuxcare.els16
libcurl
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els16
7.76.1-31.el9_2.1.tuxcare.els16
libcurl-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els16
7.76.1-31.el9_2.1.tuxcare.els16
libcurl-minimal
TuxCare:AlmaLinux:9.2
From an advisory covering 4 CVEs
 before 7.76.1-31.el9_2.1.tuxcare.els16
7.76.1-31.el9_2.1.tuxcare.els16
curl
Debian:12
 All versions, plus listed versions
7.88.1-107.88.1-10+deb12u17.88.1-10+deb12u117.88.1-10+deb12u127.88.1-10+deb12u13
Show 45 moreShow less
7.88.1-10+deb12u147.88.1-10+deb12u157.88.1-10+deb12u1~bpo11+17.88.1-10+deb12u27.88.1-10+deb12u37.88.1-10+deb12u3~bpo11+17.88.1-10+deb12u47.88.1-10+deb12u57.88.1-10+deb12u5~bpo11+17.88.1-10+deb12u67.88.1-10+deb12u6~bpo11+17.88.1-10+deb12u77.88.1-10+deb12u87.88.1-10+deb12u97.88.1-118.0.1-1~exp18.10.0-18.10.0-28.10.1-18.10.1-1~bpo12+18.10.1-28.11.0-18.11.1-18.11.1-1~bpo12+18.12.0+git20250209.89ed161+ds-18.12.0+git20250209.89ed161+ds-1~bpo12+18.12.1-18.12.1-28.12.1-2~bpo12+18.12.1-38.12.1-3~bpo12+18.13.0-18.13.0-1+exp18.13.0-28.13.0-2+exp18.13.0-38.13.0-48.13.0-4+exp18.13.0-58.13.0-5+exp18.13.0-5~bpo12+18.13.0~rc-1~exp18.13.0~rc-1~exp28.13.0~rc2-18.13.0~rc2-2
 None known
curl
Debian:13
 before 8.14.1-2+deb13u7, plus listed versions
8.14.1-28.14.1-2+deb13u18.14.1-2+deb13u28.14.1-2+deb13u2~bpo13+18.14.1-2+deb13u38.14.1-2+deb13u48.14.1-2+deb13u5
8.14.1-2+deb13u7
curl
Debian:14
 before 8.21.0~rc2-1, plus listed versions
8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1
Show 45 moreShow less
8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp8.20.0-28.20.0-2+exp18.20.0-2~bpo13+18.20.0-38.20.0-48.20.0-5
8.21.0~rc2-1
CURL_jll
Julia
 before 8.21.0+0
8.21.0+0
LibCURL_jll
Julia
 before 8.21.0+0
8.21.0+0
curl
openEuler:20.03-LTS-SP4
From an advisory covering 4 CVEs
 before 7.71.1-50.oe2003sp4
7.71.1-50.oe2003sp4
curl
openEuler:22.03-LTS-SP4
From an advisory covering 4 CVEs
 before 7.79.1-51.oe2203sp4
7.79.1-51.oe2203sp4
curl
openEuler:24.03-LTS-SP1
From an advisory covering 6 CVEs
 before 8.4.0-32.oe2403sp1
8.4.0-32.oe2403sp1
curl
openEuler:24.03-LTS-SP3
From an advisory covering 6 CVEs
 before 8.4.0-32.oe2403sp3
8.4.0-32.oe2403sp3
curl
openEuler:24.03-LTS-SP4
From an advisory covering 6 CVEs
 before 8.4.0-32.oe2403sp4
8.4.0-32.oe2403sp4
curl
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl-devel
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl-minimal
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
cargo
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
clippy
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-analyzer
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-debugger-common
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-doc
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-gdb
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-lldb
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-src
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rustfmt
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
curl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-minimal-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
libcurl-minimal
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
curl-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-minimal-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
curl
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
libcurl-minimal
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 14 CVEs
 before 0:8.12.1-1.el10_0.10
0:8.12.1-1.el10_0.10
curl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
curl-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
curl-minimal-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
libcurl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
libcurl-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
libcurl-minimal-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
curl
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
curl-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
curl-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
curl-minimal
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
curl-minimal-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
libcurl
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
libcurl-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
libcurl-minimal
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
libcurl-minimal-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
curl
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:8.12.1-4.el10_2.6
0:8.12.1-4.el10_2.6
curl
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:7.76.1-40.el9_8.8
0:7.76.1-40.el9_8.8
curl
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:7.61.1-34.el8_10.18
0:7.61.1-34.el8_10.18
curl
Root:Alpine:3.15
 before 8.5.0-r00073
8.5.0-r000738.5.0-r000748.5.0-r00075
rootio-curl
Root:Alpine:3.15
 before 8.5.0-r00073
8.5.0-r000738.5.0-r000748.5.0-r00075
curl
Root:Alpine:3.17
 before 8.9.0-r00077
8.9.0-r00077
rootio-curl
Root:Alpine:3.17
 before 8.9.0-r00077
8.9.0-r00077
curl
Root:Alpine:3.20
 before 8.14.1-r20074
8.14.1-r200748.14.1-r200758.14.1-r200768.14.1-r200778.14.1-r200788.14.1-r200798.14.1-r2007108.14.1-r2007118.14.1-r200712
rootio-curl
Root:Alpine:3.20
 before 8.14.1-r20074
8.14.1-r200748.14.1-r200758.14.1-r200768.14.1-r200778.14.1-r200788.14.1-r200798.14.1-r2007108.14.1-r2007118.14.1-r200712
curl
Root:Alpine:3.21
 before 8.14.1-r20073
8.14.1-r200738.14.1-r200748.14.1-r200758.14.1-r200768.14.1-r20077
rootio-curl
Root:Alpine:3.21
 before 8.14.1-r20073
8.14.1-r200738.14.1-r200748.14.1-r200758.14.1-r200768.14.1-r20077
curl
Root:Alpine:3.22
 before 8.14.1-r20072
8.14.1-r200728.14.1-r200718.14.1-r200738.14.1-r200748.14.1-r300758.14.1-r300768.14.1-r300778.14.1-r300788.14.1-r30079
rootio-curl
Root:Alpine:3.22
 before 8.14.1-r20072
8.14.1-r200728.14.1-r200718.14.1-r200738.14.1-r200748.14.1-r300758.14.1-r300768.14.1-r300778.14.1-r300788.14.1-r30079
curl
Root:Debian:11
 before 7.74.0-1.3+deb11u16.aikido.18
7.74.0-1.3+deb11u16.aikido.187.74.0-1.3+deb11u16.aikido.19
rootio-curl
Root:Debian:11
 before 7.74.0-1.3+deb11u16.aikido.18
7.74.0-1.3+deb11u16.aikido.187.74.0-1.3+deb11u16.aikido.19
curl
Root:Debian:12
 before 7.88.1-10+deb12u15.aikido.13
7.88.1-10+deb12u15.aikido.137.88.1-10+deb12u15.aikido.147.88.1-10+deb12u15.aikido.157.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20
rootio-curl
Root:Debian:12
 before 7.88.1-10+deb12u15.aikido.13
7.88.1-10+deb12u15.aikido.137.88.1-10+deb12u15.aikido.147.88.1-10+deb12u15.aikido.157.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20
curl
SUSE:Linux Micro 6.2
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1
curl
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1
curl-mini
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1
curl
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1
curl-mini
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1
curl
SUSE:Linux Micro 6.0
From an advisory covering 10 CVEs
 before 8.14.1-7.1
8.14.1-7.1
curl
SUSE:Linux Micro 6.1
From an advisory covering 10 CVEs
 before 8.14.1-slfo.1.1_8.1
8.14.1-slfo.1.1_8.1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 11 CVEs
 before 8.14.1-150700.7.20.1
8.14.1-150700.7.20.1
curl
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 10 CVEs
 before 8.14.1-150600.4.46.1
8.14.1-150600.4.46.1
curl
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 10 CVEs
 before 8.14.1-150600.4.46.1
8.14.1-150600.4.46.1
curl
SUSE:Linux Enterprise Installer Updates 15 SP4
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Installer Updates 15 SP5
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 10 CVEs
 before 8.14.1-150400.5.86.1
8.14.1-150400.5.86.1
curl
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 6 CVEs
 before 8.0.1-11.126.1
8.0.1-11.126.1
curl
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 6 CVEs
 before 8.0.1-11.126.1
8.0.1-11.126.1
curl
Ubuntu:Pro:16.04:LTS
 before 7.47.0-1ubuntu2.19+esm16, plus listed versions
7.43.0-1ubuntu27.45.0-1ubuntu17.46.0-1ubuntu17.47.0-1ubuntu17.47.0-1ubuntu2
Show 31 moreShow less
7.47.0-1ubuntu2.17.47.0-1ubuntu2.27.47.0-1ubuntu2.37.47.0-1ubuntu2.47.47.0-1ubuntu2.57.47.0-1ubuntu2.67.47.0-1ubuntu2.77.47.0-1ubuntu2.87.47.0-1ubuntu2.97.47.0-1ubuntu2.117.47.0-1ubuntu2.127.47.0-1ubuntu2.137.47.0-1ubuntu2.147.47.0-1ubuntu2.157.47.0-1ubuntu2.167.47.0-1ubuntu2.187.47.0-1ubuntu2.197.47.0-1ubuntu2.19+esm17.47.0-1ubuntu2.19+esm27.47.0-1ubuntu2.19+esm37.47.0-1ubuntu2.19+esm47.47.0-1ubuntu2.19+esm57.47.0-1ubuntu2.19+esm67.47.0-1ubuntu2.19+esm77.47.0-1ubuntu2.19+esm87.47.0-1ubuntu2.19+esm97.47.0-1ubuntu2.19+esm107.47.0-1ubuntu2.19+esm117.47.0-1ubuntu2.19+esm127.47.0-1ubuntu2.19+esm137.47.0-1ubuntu2.19+esm15
7.47.0-1ubuntu2.19+esm16
curl
Ubuntu:Pro:18.04:LTS
 before 7.58.0-2ubuntu3.24+esm9, plus listed versions
7.55.1-1ubuntu27.55.1-1ubuntu2.17.57.0-1ubuntu17.58.0-2ubuntu17.58.0-2ubuntu2
Show 30 moreShow less
7.58.0-2ubuntu37.58.0-2ubuntu3.17.58.0-2ubuntu3.27.58.0-2ubuntu3.37.58.0-2ubuntu3.57.58.0-2ubuntu3.67.58.0-2ubuntu3.77.58.0-2ubuntu3.87.58.0-2ubuntu3.97.58.0-2ubuntu3.107.58.0-2ubuntu3.127.58.0-2ubuntu3.137.58.0-2ubuntu3.147.58.0-2ubuntu3.157.58.0-2ubuntu3.167.58.0-2ubuntu3.177.58.0-2ubuntu3.187.58.0-2ubuntu3.197.58.0-2ubuntu3.207.58.0-2ubuntu3.217.58.0-2ubuntu3.227.58.0-2ubuntu3.237.58.0-2ubuntu3.247.58.0-2ubuntu3.24+esm17.58.0-2ubuntu3.24+esm27.58.0-2ubuntu3.24+esm37.58.0-2ubuntu3.24+esm47.58.0-2ubuntu3.24+esm57.58.0-2ubuntu3.24+esm77.58.0-2ubuntu3.24+esm8
7.58.0-2ubuntu3.24+esm9
curl
Ubuntu:Pro:20.04:LTS
 before 7.68.0-1ubuntu2.25+esm4, plus listed versions
7.65.3-1ubuntu37.65.3-1ubuntu47.66.0-1ubuntu17.67.0-2ubuntu17.68.0-1ubuntu1
Show 24 moreShow less
7.68.0-1ubuntu27.68.0-1ubuntu2.17.68.0-1ubuntu2.27.68.0-1ubuntu2.47.68.0-1ubuntu2.57.68.0-1ubuntu2.67.68.0-1ubuntu2.77.68.0-1ubuntu2.107.68.0-1ubuntu2.117.68.0-1ubuntu2.127.68.0-1ubuntu2.137.68.0-1ubuntu2.147.68.0-1ubuntu2.157.68.0-1ubuntu2.167.68.0-1ubuntu2.187.68.0-1ubuntu2.197.68.0-1ubuntu2.207.68.0-1ubuntu2.217.68.0-1ubuntu2.227.68.0-1ubuntu2.237.68.0-1ubuntu2.247.68.0-1ubuntu2.257.68.0-1ubuntu2.25+esm27.68.0-1ubuntu2.25+esm3
7.68.0-1ubuntu2.25+esm4
curl
Ubuntu:22.04:LTS
 before 7.81.0-1ubuntu1.25, plus listed versions
7.74.0-1.3ubuntu27.74.0-1.3ubuntu37.80.0-37.81.0-17.81.0-1ubuntu1.1
Show 20 moreShow less
7.81.0-1ubuntu1.27.81.0-1ubuntu1.37.81.0-1ubuntu1.47.81.0-1ubuntu1.67.81.0-1ubuntu1.77.81.0-1ubuntu1.87.81.0-1ubuntu1.107.81.0-1ubuntu1.117.81.0-1ubuntu1.137.81.0-1ubuntu1.147.81.0-1ubuntu1.157.81.0-1ubuntu1.167.81.0-1ubuntu1.177.81.0-1ubuntu1.187.81.0-1ubuntu1.197.81.0-1ubuntu1.207.81.0-1ubuntu1.217.81.0-1ubuntu1.227.81.0-1ubuntu1.237.81.0-1ubuntu1.24
7.81.0-1ubuntu1.25
curl
Ubuntu:24.04:LTS
 before 8.5.0-2ubuntu10.10, plus listed versions
8.2.1-1ubuntu38.2.1-1ubuntu3.18.4.0-2ubuntu18.5.0-2ubuntu18.5.0-2ubuntu2
Show 12 moreShow less
8.5.0-2ubuntu88.5.0-2ubuntu98.5.0-2ubuntu108.5.0-2ubuntu10.18.5.0-2ubuntu10.28.5.0-2ubuntu10.38.5.0-2ubuntu10.48.5.0-2ubuntu10.58.5.0-2ubuntu10.68.5.0-2ubuntu10.78.5.0-2ubuntu10.88.5.0-2ubuntu10.9
8.5.0-2ubuntu10.10
curl
Ubuntu:25.10
 before 8.14.1-2ubuntu1.4, plus listed versions
8.12.1-3ubuntu18.13.0-5ubuntu18.14.1-1ubuntu28.14.1-1ubuntu38.14.1-2ubuntu18.14.1-2ubuntu1.18.14.1-2ubuntu1.28.14.1-2ubuntu1.3
8.14.1-2ubuntu1.4
curl
Ubuntu:26.04:LTS
 before 8.18.0-1ubuntu2.2, plus listed versions
8.14.1-2ubuntu18.17.0-1ubuntu18.18.0-1ubuntu18.18.0-1ubuntu28.18.0-1ubuntu2.1
8.18.0-1ubuntu2.2
curl
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 8.21.0-1.1
8.21.0-1.1
libpsl
openSUSE:Tumbleweed
 before 0.23.0-1.1
0.23.0-1.1
curl
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 8.14.1-160000.8.1
8.14.1-160000.8.1

History

History
RecordedChangedSources
affectedOSV
affected, aliasesOSV
affectedOSV
affected, factsOSV
affectedOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-8924 is a critical vulnerability (CVSS 9.1) in Curl, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in curl 8.14.1-r3.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 145 versions and 90 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open