{"id":"CVE-2026-11856","aliases":["ALPINE-CVE-2026-11856","ALSA-2026:69125","ALSA-2026:80511","ALSA-2026:92368","AZL-91803","AZL-91830","BELL-CVE-2026-11856","CLSA-2026-1783703539","CLSA-2026-1783705168","CLSA-2026-1783937591","CLSA-2026-1783937768","CLSA-2026-1783937975","CLSA-2026-1783942033","CLSA-2026-1784123512","CURL-CVE-2026-11856","DEBIAN-CVE-2026-11856","EUVD-2026-41501","GHSA-9crq-qh8v-6xmm","JLSEC-2026-1201","OESA-2026-4124","OESA-2026-4125","OESA-2026-4126","OESA-2026-4127","OESA-2026-4128","RHSA-2026:29017","RHSA-2026:34975","RHSA-2026:69125","RHSA-2026:72506","RHSA-2026:80511","RLSA-2026:69125","RLSA-2026:80511","RLSA-2026:92368","ROOT-OS-ALPINE-315-CVE-2026-11856","ROOT-OS-ALPINE-317-CVE-2026-11856","ROOT-OS-ALPINE-320-CVE-2026-11856","ROOT-OS-ALPINE-321-CVE-2026-11856","ROOT-OS-ALPINE-322-CVE-2026-11856","ROOT-OS-ALPINE-323-CVE-2026-11856","ROOT-OS-DEBIAN-11-CVE-2026-11856","ROOT-OS-DEBIAN-12-CVE-2026-11856","ROOT-OS-DEBIAN-13-CVE-2026-11856","ROOT-OS-UBUNTU-2404-CVE-2026-11856","SUSE-SU-2026:4954-1","SUSE-SU-2026:5068-1","SUSE-SU-2026:5069-1","SUSE-SU-2026:5071-1","UBUNTU-CVE-2026-11856","USN-8651-1","openSUSE-SU-2026:11230-1"],"status":"published","title":"cross-origin Digest auth state leak","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00688,"percentile":0.532,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-294"],"published":"2026-06-24T08:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.11.1-11"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-15"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl-minimal","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-devel","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-minimal","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"curl","fixed_in":["7.61.1-22.el8.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","fixed_in":["7.61.1-22.el8.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","fixed_in":["7.61.1-22.el8.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","fixed_in":["7.61.1-22.el8.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","fixed_in":["7.61.1-22.el8.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"curl","fixed_in":["7.58.0-2ubuntu3.24+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl3-gnutls","fixed_in":["7.58.0-2ubuntu3.24+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl3-nss","fixed_in":["7.58.0-2ubuntu3.24+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl4","fixed_in":["7.58.0-2ubuntu3.24+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl4-doc","fixed_in":["7.58.0-2ubuntu3.24+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl4-gnutls-dev","fixed_in":["7.58.0-2ubuntu3.24+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl4-nss-dev","fixed_in":["7.58.0-2ubuntu3.24+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl4-openssl-dev","fixed_in":["7.58.0-2ubuntu3.24+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"curl","fixed_in":["7.47.0-1ubuntu2.23+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3","fixed_in":["7.47.0-1ubuntu2.23+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-gnutls","fixed_in":["7.47.0-1ubuntu2.23+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-nss","fixed_in":["7.47.0-1ubuntu2.23+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-doc","fixed_in":["7.47.0-1ubuntu2.23+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-gnutls-dev","fixed_in":["7.47.0-1ubuntu2.23+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-nss-dev","fixed_in":["7.47.0-1ubuntu2.23+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-openssl-dev","fixed_in":["7.47.0-1ubuntu2.23+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"curl","fixed_in":["7.61.1-22.el8.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"curl-minimal","fixed_in":["7.61.1-22.el8.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libcurl","fixed_in":["7.61.1-22.el8.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-devel","fixed_in":["7.61.1-22.el8.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-minimal","fixed_in":["7.61.1-22.el8.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"curl","fixed_in":["7.61.1-34.el8.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"curl-minimal","fixed_in":["7.61.1-34.el8.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl","fixed_in":["7.61.1-34.el8.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-devel","fixed_in":["7.61.1-34.el8.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-minimal","fixed_in":["7.61.1-34.el8.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.21.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.21.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.21.0+0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"curl","fixed_in":["8.9.0-r00072","8.9.0-r00073","8.9.0-r00074","8.9.0-r00075","8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"rootio-curl","fixed_in":["8.9.0-r00072","8.9.0-r00073","8.9.0-r00074","8.9.0-r00075","8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"curl","fixed_in":["8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r20078","8.14.1-r20079","8.14.1-r200710","8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-curl","fixed_in":["8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r20078","8.14.1-r20079","8.14.1-r200710","8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"curl","fixed_in":["8.14.1-r20073","8.14.1-r30078","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-curl","fixed_in":["8.14.1-r20073","8.14.1-r30078","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"curl","fixed_in":["8.14.1-r20072","8.14.1-r20071","8.14.1-r20073","8.14.1-r20074","8.14.1-r400710","8.14.1-r30075","8.14.1-r30076","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"rootio-curl","fixed_in":["8.14.1-r20072","8.14.1-r20071","8.14.1-r20073","8.14.1-r20074","8.14.1-r400710","8.14.1-r30075","8.14.1-r30076","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"curl","fixed_in":["7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-curl","fixed_in":["7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"curl","fixed_in":["7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-curl","fixed_in":["7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u7.aikido.24","8.14.1-2+deb13u7.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-curl","fixed_in":["8.14.1-2+deb13u7.aikido.24","8.14.1-2+deb13u7.aikido.25"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.20+esm22"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.19+esm18"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.24+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.25+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"curl","fixed_in":["7.81.0-1ubuntu1.26"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"curl","fixed_in":["8.5.0-2ubuntu10.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"curl","fixed_in":["8.18.0-1ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.6"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.6"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8_10.18"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8_10.18"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8_10.18"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8_10.18"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.1-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-15"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl3-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl3-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl4-gnutls-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl4-nss-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcurl4-openssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl3-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-gnutls-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-nss-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libcurl4-openssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u11","7.88.1-10+deb12u12","7.88.1-10+deb12u13","7.88.1-10+deb12u14","7.88.1-10+deb12u15","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6","7.88.1-10+deb12u6~bpo11+1","7.88.1-10+deb12u7","7.88.1-10+deb12u8","7.88.1-10+deb12u9","7.88.1-11","8.0.1-1~exp1","8.10.0-1","8.10.0-2","8.10.1-1","8.10.1-1~bpo12+1","8.10.1-2","8.11.0-1","8.11.1-1","8.11.1-1~bpo12+1","8.12.0+git20250209.89ed161+ds-1","8.12.0+git20250209.89ed161+ds-1~bpo12+1","8.12.1-1","8.12.1-2","8.12.1-2~bpo12+1","8.12.1-3","8.12.1-3~bpo12+1","8.13.0-1","8.13.0-1+exp1","8.13.0-2","8.13.0-2+exp1","8.13.0-3","8.13.0-4","8.13.0-4+exp1","8.13.0-5","8.13.0-5+exp1","8.13.0-5~bpo12+1","8.13.0~rc-1~exp1","8.13.0~rc-1~exp2","8.13.0~rc2-1","8.13.0~rc2-2","8.13.0~rc3-1","8.13.0~rc3-1+exp1","8.14.0-1","8.14.0-1+exp1","8.14.0~rc1-1+exp1","8.14.0~rc2-1+exp1","8.14.0~rc3-1+exp1","8.14.1-1","8.14.1-1~bpo12+1","8.14.1-2","8.14.1-2+exp1","8.14.1-2~bpo12+1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.2.1-1","8.2.1-2","8.2.1-2~bpo12+1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1","8.3.0-1","8.3.0-2","8.3.0-2~bpo12+1","8.3.0-2~exp1","8.3.0-3","8.4.0-1","8.4.0-2","8.4.0-2~bpo12+1","8.5.0-1","8.5.0-1+exp1","8.5.0-2","8.5.0-2+exp1","8.5.0-2~bpo12+1","8.6.0-1","8.6.0-1.1","8.6.0-2","8.6.0-3","8.6.0-3.1","8.6.0-3.1~exp1","8.6.0-3.1~exp2","8.6.0-3.2","8.6.0-4","8.7.1-1","8.7.1-1+exp1","8.7.1-2","8.7.1-3","8.7.1-4","8.7.1-5","8.7.1-5+exp1","8.7.1-5~bpo12+1","8.8.0-1","8.8.0-1+exp1","8.8.0-1+exp2","8.8.0-1~bpo12+1","8.8.0-2","8.8.0-3","8.8.0-4","8.9.0-1","8.9.0-2","8.9.0-3","8.9.1-1","8.9.1-2","8.9.1-2~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.1-2","8.14.1-2+deb13u1","8.14.1-2+deb13u2","8.14.1-2+deb13u2~bpo13+1","8.14.1-2+deb13u3","8.14.1-2+deb13u4","8.14.1-2+deb13u5","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.21.0~rc3-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1"]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.21.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.21.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-54.oe2003sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-56.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-37.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-37.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-37.oe2403sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-none-softfloat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-i686-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-wasip1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-none","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.18"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00072"},{"fixed":"8.9.0-r00073"},{"fixed":"8.9.0-r00074"},{"fixed":"8.9.0-r00075"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00072"},{"fixed":"8.9.0-r00073"},{"fixed":"8.9.0-r00074"},{"fixed":"8.9.0-r00075"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r20078"},{"fixed":"8.14.1-r20079"},{"fixed":"8.14.1-r200710"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r20078"},{"fixed":"8.14.1-r20079"},{"fixed":"8.14.1-r200710"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30075"},{"fixed":"8.14.1-r30076"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30075"},{"fixed":"8.14.1-r30076"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u7.aikido.24"},{"fixed":"8.14.1-2+deb13u7.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u7.aikido.24"},{"fixed":"8.14.1-2+deb13u7.aikido.25"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.98.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.22.0-150700.7.33.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.22.0-150600.4.58.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.22.0-150600.4.58.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.134.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.134.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm22"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13","7.35.0-1ubuntu2.20+esm14","7.35.0-1ubuntu2.20+esm15","7.35.0-1ubuntu2.20+esm16","7.35.0-1ubuntu2.20+esm17","7.35.0-1ubuntu2.20+esm18","7.35.0-1ubuntu2.20+esm19","7.35.0-1ubuntu2.20+esm20","7.35.0-1ubuntu2.20+esm21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm18"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2","7.47.0-1ubuntu2.19+esm3","7.47.0-1ubuntu2.19+esm4","7.47.0-1ubuntu2.19+esm5","7.47.0-1ubuntu2.19+esm6","7.47.0-1ubuntu2.19+esm7","7.47.0-1ubuntu2.19+esm8","7.47.0-1ubuntu2.19+esm9","7.47.0-1ubuntu2.19+esm10","7.47.0-1ubuntu2.19+esm11","7.47.0-1ubuntu2.19+esm12","7.47.0-1ubuntu2.19+esm13","7.47.0-1ubuntu2.19+esm15","7.47.0-1ubuntu2.19+esm16","7.47.0-1ubuntu2.19+esm17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+esm11"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16","7.58.0-2ubuntu3.17","7.58.0-2ubuntu3.18","7.58.0-2ubuntu3.19","7.58.0-2ubuntu3.20","7.58.0-2ubuntu3.21","7.58.0-2ubuntu3.22","7.58.0-2ubuntu3.23","7.58.0-2ubuntu3.24","7.58.0-2ubuntu3.24+esm1","7.58.0-2ubuntu3.24+esm2","7.58.0-2ubuntu3.24+esm3","7.58.0-2ubuntu3.24+esm4","7.58.0-2ubuntu3.24+esm5","7.58.0-2ubuntu3.24+esm7","7.58.0-2ubuntu3.24+esm8","7.58.0-2ubuntu3.24+esm9","7.58.0-2ubuntu3.24+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.25+esm6"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15","7.68.0-1ubuntu2.16","7.68.0-1ubuntu2.18","7.68.0-1ubuntu2.19","7.68.0-1ubuntu2.20","7.68.0-1ubuntu2.21","7.68.0-1ubuntu2.22","7.68.0-1ubuntu2.23","7.68.0-1ubuntu2.24","7.68.0-1ubuntu2.25","7.68.0-1ubuntu2.25+esm2","7.68.0-1ubuntu2.25+esm3","7.68.0-1ubuntu2.25+esm4","7.68.0-1ubuntu2.25+esm5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.26"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15","7.81.0-1ubuntu1.16","7.81.0-1ubuntu1.17","7.81.0-1ubuntu1.18","7.81.0-1ubuntu1.19","7.81.0-1ubuntu1.20","7.81.0-1ubuntu1.21","7.81.0-1ubuntu1.22","7.81.0-1ubuntu1.23","7.81.0-1ubuntu1.24","7.81.0-1ubuntu1.25"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.12"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6","8.5.0-2ubuntu10.7","8.5.0-2ubuntu10.8","8.5.0-2ubuntu10.9","8.5.0-2ubuntu10.10","8.5.0-2ubuntu10.11"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1","8.14.1-2ubuntu1.1","8.14.1-2ubuntu1.2","8.14.1-2ubuntu1.3","8.14.1-2ubuntu1.4","8.14.1-2ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.4"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1","8.18.0-1ubuntu2","8.18.0-1ubuntu2.1","8.18.0-1ubuntu2.2","8.18.0-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm22"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3","7.35.0-1ubuntu2.20+esm4","7.35.0-1ubuntu2.20+esm5","7.35.0-1ubuntu2.20+esm6","7.35.0-1ubuntu2.20+esm7","7.35.0-1ubuntu2.20+esm8","7.35.0-1ubuntu2.20+esm9","7.35.0-1ubuntu2.20+esm10","7.35.0-1ubuntu2.20+esm11","7.35.0-1ubuntu2.20+esm12","7.35.0-1ubuntu2.20+esm13","7.35.0-1ubuntu2.20+esm14","7.35.0-1ubuntu2.20+esm15","7.35.0-1ubuntu2.20+esm16","7.35.0-1ubuntu2.20+esm17","7.35.0-1ubuntu2.20+esm18","7.35.0-1ubuntu2.20+esm19","7.35.0-1ubuntu2.20+esm20","7.35.0-1ubuntu2.20+esm21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm18"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2","7.47.0-1ubuntu2.19+esm3","7.47.0-1ubuntu2.19+esm4","7.47.0-1ubuntu2.19+esm5","7.47.0-1ubuntu2.19+esm6","7.47.0-1ubuntu2.19+esm7","7.47.0-1ubuntu2.19+esm8","7.47.0-1ubuntu2.19+esm9","7.47.0-1ubuntu2.19+esm10","7.47.0-1ubuntu2.19+esm11","7.47.0-1ubuntu2.19+esm12","7.47.0-1ubuntu2.19+esm13","7.47.0-1ubuntu2.19+esm15","7.47.0-1ubuntu2.19+esm16","7.47.0-1ubuntu2.19+esm17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+esm11"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16","7.58.0-2ubuntu3.17","7.58.0-2ubuntu3.18","7.58.0-2ubuntu3.19","7.58.0-2ubuntu3.20","7.58.0-2ubuntu3.21","7.58.0-2ubuntu3.22","7.58.0-2ubuntu3.23","7.58.0-2ubuntu3.24","7.58.0-2ubuntu3.24+esm1","7.58.0-2ubuntu3.24+esm2","7.58.0-2ubuntu3.24+esm3","7.58.0-2ubuntu3.24+esm4","7.58.0-2ubuntu3.24+esm5","7.58.0-2ubuntu3.24+esm7","7.58.0-2ubuntu3.24+esm8","7.58.0-2ubuntu3.24+esm9","7.58.0-2ubuntu3.24+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.25+esm6"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15","7.68.0-1ubuntu2.16","7.68.0-1ubuntu2.18","7.68.0-1ubuntu2.19","7.68.0-1ubuntu2.20","7.68.0-1ubuntu2.21","7.68.0-1ubuntu2.22","7.68.0-1ubuntu2.23","7.68.0-1ubuntu2.24","7.68.0-1ubuntu2.25","7.68.0-1ubuntu2.25+esm2","7.68.0-1ubuntu2.25+esm3","7.68.0-1ubuntu2.25+esm4","7.68.0-1ubuntu2.25+esm5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.26"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15","7.81.0-1ubuntu1.16","7.81.0-1ubuntu1.17","7.81.0-1ubuntu1.18","7.81.0-1ubuntu1.19","7.81.0-1ubuntu1.20","7.81.0-1ubuntu1.21","7.81.0-1ubuntu1.22","7.81.0-1ubuntu1.23","7.81.0-1ubuntu1.24","7.81.0-1ubuntu1.25"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.12"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6","8.5.0-2ubuntu10.7","8.5.0-2ubuntu10.8","8.5.0-2ubuntu10.9","8.5.0-2ubuntu10.10","8.5.0-2ubuntu10.11"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.4"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1","8.18.0-1ubuntu2","8.18.0-1ubuntu2.1","8.18.0-1ubuntu2.2","8.18.0-1ubuntu2.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.21.0-1.1"}]}],"bundled":18}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-11856.json","tags":["Vendor Advisory","web","article"]},{"url":"https://curl.se/docs/CVE-2026-11856.html","tags":["Patch","Vendor Advisory","web","article"]},{"url":"https://hackerone.com/reports/3793260","tags":["exploit","Exploit","Issue Tracking","Third Party Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9crq-qh8v-6xmm","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-11856","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69125","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11856","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8458","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8924","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8926","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8932","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9079","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496759","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496760","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496764","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496765","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496767","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496771","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-69125.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80511","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-80511.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92368","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8927","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496769","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-92368.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-11856","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1783703539.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783705168.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1783937591.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1783937768.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1783937975.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1783942033.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1784123512.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11856.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-11856","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4124","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4125","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4127","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4128","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29017","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12064","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8286","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11352","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11586","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9546","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8925","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11564","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9080","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9547","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29017.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8286","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8286.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8286.json","tags":["article"]},{"url":"https://hackerone.com/reports/3718195","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496764","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8458","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8458.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8458.json","tags":["article"]},{"url":"https://hackerone.com/reports/3721183","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496765","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8924","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8924.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8924.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733905","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8925.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8925.json","tags":["article"]},{"url":"https://hackerone.com/reports/3735193","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496760","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8926.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8926.json","tags":["article"]},{"url":"https://hackerone.com/reports/3735184","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496769","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8927","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8927.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8927.json","tags":["article"]},{"url":"https://hackerone.com/reports/3744543","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8932.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8932.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733910","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496771","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9079.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9079.json","tags":["article"]},{"url":"https://hackerone.com/reports/3750295","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9080.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9080.json","tags":["article"]},{"url":"https://hackerone.com/reports/3749204","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496770","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9546.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9546.json","tags":["article"]},{"url":"https://hackerone.com/reports/3754343","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496758","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9547.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9547.json","tags":["article"]},{"url":"https://hackerone.com/reports/3751712","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496757","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11352","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11352.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11352.json","tags":["article"]},{"url":"https://hackerone.com/reports/3783438","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11564","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11564.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11564.json","tags":["article"]},{"url":"https://hackerone.com/reports/3788984","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496753","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11586","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11586.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11586.json","tags":["article"]},{"url":"https://hackerone.com/reports/3788931","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11856","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-12064.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-12064.json","tags":["article"]},{"url":"https://hackerone.com/reports/3797526","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34975","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-38969","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14683","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14685","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14686","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14684","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59870","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59868","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15187","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34975.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497102","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14683","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/","tags":["article"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/219","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14683","tags":["article"]},{"url":"https://vuldb.com/submit/846750","tags":["article"]},{"url":"https://vuldb.com/submit/846752","tags":["article"]},{"url":"https://vuldb.com/vuln/376279","tags":["article"]},{"url":"https://vuldb.com/vuln/376279/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14684","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/220","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14684","tags":["article"]},{"url":"https://vuldb.com/submit/846754","tags":["article"]},{"url":"https://vuldb.com/vuln/376280","tags":["article"]},{"url":"https://vuldb.com/vuln/376280/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497101","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14685","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/221","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14685","tags":["article"]},{"url":"https://vuldb.com/submit/846761","tags":["article"]},{"url":"https://vuldb.com/vuln/376281","tags":["article"]},{"url":"https://vuldb.com/vuln/376281/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14686","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/222","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14686","tags":["article"]},{"url":"https://vuldb.com/submit/846762","tags":["article"]},{"url":"https://vuldb.com/vuln/376282","tags":["article"]},{"url":"https://vuldb.com/vuln/376282/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15187","tags":["advisory"]},{"url":"https://github.com/enquirer/enquirer/","tags":["article"]},{"url":"https://github.com/enquirer/enquirer/issues/487","tags":["article"]},{"url":"https://github.com/enquirer/enquirer/issues/487#issuecomment-4648521328","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-15187","tags":["article"]},{"url":"https://vuldb.com/submit/851357","tags":["article"]},{"url":"https://vuldb.com/vuln/377113","tags":["article"]},{"url":"https://vuldb.com/vuln/377113/cti","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-38969","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59868","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59870","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69125.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72506","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446450","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72506.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14819","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14819","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14819.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1965","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1965","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-1965.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-1965.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/2","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3783.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3783.json","tags":["article"]},{"url":"https://hackerone.com/reports/3583983","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3784","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/3","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.json","tags":["article"]},{"url":"https://hackerone.com/reports/3584903","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80511.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69125","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80511","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92368","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264954-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268414","tags":["report"]},{"url":"https://bugzilla.suse.com/1268426","tags":["report"]},{"url":"https://bugzilla.suse.com/1277477","tags":["report"]},{"url":"https://bugzilla.suse.com/1277478","tags":["report"]},{"url":"https://bugzilla.suse.com/1277482","tags":["report"]},{"url":"https://bugzilla.suse.com/1278173","tags":["report"]},{"url":"https://bugzilla.suse.com/1285008","tags":["report"]},{"url":"https://bugzilla.suse.com/1285010","tags":["report"]},{"url":"https://bugzilla.suse.com/1285012","tags":["report"]},{"url":"https://bugzilla.suse.com/1285013","tags":["report"]},{"url":"https://bugzilla.suse.com/1285014","tags":["report"]},{"url":"https://bugzilla.suse.com/1285015","tags":["report"]},{"url":"https://bugzilla.suse.com/1285016","tags":["report"]},{"url":"https://bugzilla.suse.com/1285017","tags":["report"]},{"url":"https://bugzilla.suse.com/1285018","tags":["report"]},{"url":"https://bugzilla.suse.com/1285021","tags":["report"]},{"url":"https://bugzilla.suse.com/1285022","tags":["report"]},{"url":"https://bugzilla.suse.com/1285023","tags":["report"]},{"url":"https://bugzilla.suse.com/1285026","tags":["report"]},{"url":"https://bugzilla.suse.com/1285030","tags":["report"]},{"url":"https://bugzilla.suse.com/1285031","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94266","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265068-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268419","tags":["report"]},{"url":"https://bugzilla.suse.com/1268423","tags":["report"]},{"url":"https://bugzilla.suse.com/1268424","tags":["report"]},{"url":"https://bugzilla.suse.com/1268425","tags":["report"]},{"url":"https://bugzilla.suse.com/1268427","tags":["report"]},{"url":"https://bugzilla.suse.com/1285011","tags":["report"]},{"url":"https://bugzilla.suse.com/1285024","tags":["report"]},{"url":"https://bugzilla.suse.com/1285027","tags":["report"]},{"url":"https://bugzilla.suse.com/1285028","tags":["report"]},{"url":"https://bugzilla.suse.com/1285029","tags":["report"]},{"url":"https://bugzilla.suse.com/1287781","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9546","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265069-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265071-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8458","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-11856","tags":["report"]},{"url":"https://curl.se/L7HzKXisfJ/CVE-2026-11856.md","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8651-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9547","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-11856","title":"cross-origin Digest auth state leak","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.","status":"published","published":"2026-07-03T06:13:31.661Z","modified":"2026-09-15T06:02:42.79Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:20:04.809935Z"}],"euvd":[{"id":"EUVD-2026-41501","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.","status":"published","published":"2026-07-03T06:13:31Z","modified":"2026-09-15T06:02:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-9crq-qh8v-6xmm","title":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest**...","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the  `Authorization:` header field meant for `hostA`,\nto `hostB`.","status":"published","published":"2026-07-03T09:31:26Z","modified":"2026-07-07T21:32:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:09:18.783285Z"}],"nvd":[{"id":"CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.","status":"published","published":"2026-07-03T07:16:23.973Z","modified":"2026-09-15T07:16:25.87Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:12:27.541515Z"}],"osv":[{"id":"ALPINE-CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.","status":"published","published":"2026-07-03T07:16:23.973Z","modified":"2026-10-01T02:17:49.173396519Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-11856","status":"published","published":"2026-06-26T06:12:22.504332Z","modified":"2026-07-08T07:15:04.284937634Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-11856","title":"cross-origin Digest auth state leak","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.","status":"published","published":"2026-07-03T06:13:31.661Z","modified":"2026-11-03T22:56:56.850935942Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-294"],"updated_at":"2026-11-03T23:33:40.031248Z"},{"id":"DEBIAN-CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.","status":"published","published":"2026-07-03T07:16:23.973Z","modified":"2026-10-01T03:02:23.397448314Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"JLSEC-2026-1201","title":"Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest**...","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the  `Authorization:` header field meant for `hostA`,\nto `hostB`.","status":"published","published":"2026-08-07T20:11:58.984Z","modified":"2026-08-07T20:28:41.685488409Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-4124","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSuccessfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.(CVE-2026-11856)\n\nA flaw in libcurl\u0026apos;s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.(CVE-2026-18924)\n\nA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0026apos;s request get sent over user A\u0026apos;s\npreviously authenticated connection.(CVE-2026-19931)\n\nWhen `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)\n\nA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)\n\nWhen libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).(CVE-2026-82209)","status":"published","published":"2026-09-25T01:28:45Z","modified":"2026-09-25T01:45:14.616534315Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4125","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSuccessfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.(CVE-2026-11856)\n\nA flaw in libcurl\u0026apos;s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.(CVE-2026-18924)\n\nA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0026apos;s request get sent over user A\u0026apos;s\npreviously authenticated connection.(CVE-2026-19931)\n\nWhen `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)\n\nA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)\n\nWhen libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).(CVE-2026-82209)","status":"published","published":"2026-09-25T01:28:45Z","modified":"2026-09-25T01:45:09.204392978Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4126","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSuccessfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.(CVE-2026-11856)\n\nA flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation.(CVE-2026-13608)\n\nA flaw in libcurl\u0026apos;s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.(CVE-2026-18924)\n\nA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0026apos;s request get sent over user A\u0026apos;s\npreviously authenticated connection.(CVE-2026-19931)\n\nWhen `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)\n\nA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)\n\nWhen libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).(CVE-2026-82209)","status":"published","published":"2026-09-25T01:28:47Z","modified":"2026-09-25T01:45:13.706912325Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4127","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSuccessfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.(CVE-2026-11856)\n\nA flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation.(CVE-2026-13608)\n\nA flaw in libcurl\u0026apos;s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.(CVE-2026-18924)\n\nA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0026apos;s request get sent over user A\u0026apos;s\npreviously authenticated connection.(CVE-2026-19931)\n\nWhen `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)\n\nA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)\n\nWhen libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).(CVE-2026-82209)","status":"published","published":"2026-09-25T01:28:47Z","modified":"2026-09-25T01:45:14.613657768Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4128","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSuccessfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.(CVE-2026-11856)\n\nA flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation.(CVE-2026-13608)\n\nA flaw in libcurl\u0026apos;s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.(CVE-2026-18924)\n\nA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0026apos;s request get sent over user A\u0026apos;s\npreviously authenticated connection.(CVE-2026-19931)\n\nWhen `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)\n\nA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)\n\nWhen libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).(CVE-2026-82209)","status":"published","published":"2026-09-25T01:28:47Z","modified":"2026-09-25T01:45:14.618674629Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:29017","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-16T10:07:43Z","modified":"2026-10-17T10:11:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:34975","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-04T10:07:59Z","modified":"2026-10-17T10:12:31Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:69125","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-09-22T10:19:47Z","modified":"2026-10-16T10:23:50Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:72506","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-09-29T10:18:29Z","modified":"2026-10-16T10:24:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:80511","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-10-14T10:31:48Z","modified":"2026-10-16T10:26:25Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:69125","title":"Important: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)\n\n* curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)\n\n* curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)\n\n* curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)\n\n* curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)\n\n* libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-22T12:08:07.529031Z","modified":"2026-09-22T12:30:02.634508572Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80511","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)\n\n* curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:04:29.039883Z","modified":"2026-10-13T12:30:03.422212715Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:92368","title":"Important: curl security, bug fix, and enhancement update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)\n\n* curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)\n\n* curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)\n\n* curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)\n\n* curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)\n\nBug Fix(es) and Enhancement(s):\n\n* Backport upstream curl PR #6852 (\"h2: allow 100 streams by default\") to Rocky Linux 8 libcurl (JIRA:Rocky Linux-232829)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:01:09.65921Z","modified":"2026-10-30T12:30:02.298695995Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.","status":"published","published":"2026-06-24T14:00:00Z","modified":"2026-09-24T02:00:15.782652431Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:00.081948Z"},{"id":"ALSA-2026:69125","title":"Important: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  \n\nSecurity Fix(es):  \n\n  * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)\n  * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)\n  * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)\n  * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)\n  * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)\n  * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-10-29T11:30:41.694588463Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80511","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  \n\nSecurity Fix(es):  \n\n  * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)\n  * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:32:37.979854507Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:92368","title":"Important: curl security, bug fix, and enhancement update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  \n\nSecurity Fix(es):  \n\n  * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)\n  * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)\n  * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)\n  * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)\n  * curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Backport upstream curl PR #6852 (\"h2: allow 100 streams by default\") to AlmaLinux 8 libcurl (JIRA:RHEL-232829)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:30:02.485240674Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-91803","title":"CVE-2026-11856 affecting package curl for versions less than 8.11.1-11","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.","status":"published","published":"2026-07-03T07:16:23Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"AZL-91830","title":"CVE-2026-11856 affecting package cmake for versions less than 3.30.3-15","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.","status":"published","published":"2026-07-03T07:16:23Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1783703539","title":"curl: Fix of CVE-2026-11856","description":"- CVE-2026-11856: flush cached HTTP Digest auth state when the origin or\n  credentials change on the same easy handle so a challenge computed for one\n  origin or set of credentials is not reused for another","status":"published","published":"2026-07-10T17:12:42Z","modified":"2026-10-26T09:31:14.533486081Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783705168","title":"curl: Fix of CVE-2026-11856","description":"- CVE-2026-11856: flush cached HTTP Digest auth state when the origin or\n  credentials change on the same easy handle so a challenge computed for one\n  origin or set of credentials is not reused for another","status":"published","published":"2026-07-10T17:39:54Z","modified":"2026-10-26T09:30:25.750964631Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783937591","title":"curl: Fix of 2 CVEs","description":"- CVE-2026-11856: flush Digest auth state on origin or credential change to\n  avoid leaking the Authorization header across origins on handle reuse","status":"published","published":"2026-08-06T08:51:22Z","modified":"2026-10-26T09:31:49.609102897Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783937768","title":"Fix of 5 CVEs","description":"   * SECURITY UPDATE: cross-origin Digest authentication state leak\n     - debian/patches/CVE-2026-11856.patch: flush the cached Digest state in\n       lib/http_digest.c, lib/urldata.h and lib/vauth/digest.c when the origin\n       or credentials it was created for change on a reused handle, so an\n       Authorization/Proxy-Authorization header is not sent to a different\n       origin.\n     - CVE-2026-11856","status":"published","published":"2026-07-20T09:42:09Z","modified":"2026-10-26T09:32:03.237074202Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783937975","title":"Fix CVE(s): CVE-2026-11856","description":"   * SECURITY UPDATE: cross-origin Digest authentication state leak\n     - debian/patches/CVE-2026-11856.patch: flush the cached Digest state in\n       lib/http_digest.c, lib/urldata.h and lib/curl_sasl.c when the origin or\n       credentials it was created for change on a reused handle, so an\n       Authorization/Proxy-Authorization header is not sent to a different\n       origin.\n     - CVE-2026-11856","status":"published","published":"2026-07-13T10:19:50Z","modified":"2026-10-26T09:31:47.110312236Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783942033","title":"curl: Fix of 2 CVEs","description":"- CVE-2026-11856: flush Digest auth state on origin or credential change to\n  avoid leaking the Authorization header across origins on handle reuse","status":"published","published":"2026-08-06T08:57:00Z","modified":"2026-10-26T09:31:51.119119563Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784123512","title":"curl: Fix of 2 CVEs","description":"- CVE-2026-11856: flush Digest auth state on origin or credential change to\n  avoid leaking the Authorization header across origins on handle reuse","status":"published","published":"2026-08-06T09:37:34Z","modified":"2026-10-26T09:31:37.803913267Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CURL-CVE-2026-11856","title":"cross-origin Digest auth state leak","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.","status":"published","published":"2026-06-24T08:00:00Z","modified":"2026-10-25T01:05:12.194446749Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2026:11230-1","title":"curl-8.21.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.392224841Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2026-11856","title":"CVE-2026-11856 in curl - Patched by Root","description":"Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-11-04T10:54:49Z","modified":"2026-11-04T11:15:04.04525302Z","updated_at":"2026-11-04T11:38:21.953745Z"},{"id":"ROOT-OS-ALPINE-317-CVE-2026-11856","title":"CVE-2026-11856 in curl - Patched by Root","description":"Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.","status":"published","published":"2026-11-04T16:15:55Z","modified":"2026-11-04T17:15:24.336591892Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-11856","title":"CVE-2026-11856 in curl - Patched by Root","description":"Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:40:45Z","modified":"2026-09-29T10:15:24.552005421Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-11856","title":"CVE-2026-11856 in curl - Patched by Root","description":"Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-11-03T11:37:01Z","modified":"2026-11-03T12:15:04.059367267Z","updated_at":"2026-11-03T12:31:35.467775Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2026-11856","title":"CVE-2026-11856 in curl - Patched by Root","description":"Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.","status":"published","published":"2026-10-19T06:56:08Z","modified":"2026-10-19T07:15:07.967640767Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-323-CVE-2026-11856","title":"CVE-2026-11856 in curl - Patched by Root","description":"Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-11T14:25:22Z","modified":"2026-10-09T13:00:09.074792848Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-11856","title":"CVE-2026-11856 in curl - Patched by Root","description":"Root has patched CVE-2026-11856 in the curl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T12:49:54Z","modified":"2026-08-20T13:30:12.523476577Z","updated_at":"2026-11-02T15:53:29.631993Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-11856","title":"CVE-2026-11856 in curl - Patched by Root","description":"Root has patched CVE-2026-11856 in the curl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-04T06:00:50Z","modified":"2026-11-04T07:15:07.475896443Z","updated_at":"2026-11-04T07:32:23.735279Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-11856","title":"CVE-2026-11856 in curl - Patched by Root","description":"Root has patched CVE-2026-11856 in the curl package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-11-03T10:50:30Z","modified":"2026-11-03T11:15:09.884369716Z","updated_at":"2026-11-03T11:30:16.221977Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2026-11856","title":"CVE-2026-11856 in rootio-curl - Patched by Root","description":"Root has patched CVE-2026-11856 in the rootio-curl package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"withdrawn","published":"2026-07-29T06:35:08Z","modified":"2026-10-09T13:00:19.143075059Z","updated_at":"2026-11-02T15:53:38.418039Z"},{"id":"SUSE-SU-2026:4954-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).\n- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).\n- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).\n- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).\n- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).\n- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).\n- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).\n- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).\n- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).\n- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).\n- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).\n- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).\n- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).\n- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).\n- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).\n- CVE-2026-92389: TFTP direction confusion (bsc#1285015).\n- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).\n- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).\n- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).\n- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).\n- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).\n","status":"published","published":"2026-10-30T16:20:13Z","modified":"2026-11-02T17:23:10.113104458Z","updated_at":"2026-11-02T18:00:32.560004Z"},{"id":"SUSE-SU-2026:5068-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).\n- CVE-2026-9546: sending old referer (bsc#1268419).\n- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).\n- CVE-2026-11564: Native CA trust persist (bsc#1268424).\n- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).\n- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).\n- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).\n- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).\n- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).\n- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).\n- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).\n- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).\n- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).\n- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).\n- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).\n- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).\n- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).\n- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).\n- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).\n- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).\n- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).\n- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).\n- CVE-2026-92389: TFTP direction confusion (bsc#1285015).\n- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).\n- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).\n- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).\n- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).\n- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).\n- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).\n  \nChanges for curl:\n\n- Updated curl to version 8.22.0. (jsc#PED-16984)\n","status":"published","published":"2026-11-03T08:13:17Z","modified":"2026-11-03T22:45:04.218292646Z","updated_at":"2026-11-03T22:59:30.419462Z"},{"id":"SUSE-SU-2026:5069-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).\n- CVE-2026-9546: sending old referer (bsc#1268419).\n- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).\n- CVE-2026-11564: Native CA trust persist (bsc#1268424).\n- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).\n- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).\n- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).\n- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).\n- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).\n- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).\n- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).\n- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).\n- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).\n- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).\n- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).\n- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).\n- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).\n- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).\n- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).\n- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).\n- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).\n- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).\n- CVE-2026-92389: TFTP direction confusion (bsc#1285015).\n- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).\n- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).\n- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).\n- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).\n- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).\n- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).\n\nChanges for curl:\n\n- Updated to version 8.22.0. (jsc#PED-16984)\n","status":"published","published":"2026-11-03T08:13:44Z","modified":"2026-11-03T22:45:05.964085219Z","updated_at":"2026-11-03T22:59:30.419462Z"},{"id":"SUSE-SU-2026:5071-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).\n- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).\n- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).\n- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).\n- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).\n- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).\n- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).\n- CVE-2026-92389: TFTP direction confusion (bsc#1285015).\n- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).\n- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).\n","status":"published","published":"2026-11-03T08:14:35Z","modified":"2026-11-03T22:45:03.520972957Z","updated_at":"2026-11-03T22:59:30.419462Z"},{"id":"USN-8651-1","title":"curl vulnerability","description":"It was discovered that curl incorrectly handled reusing connections\nwhen the origin changed between transfers. A remote attacker could\npossibly use this issue to obtain sensitive information.","status":"published","published":"2026-08-19T16:44:20Z","modified":"2026-08-20T05:27:00.137379945Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}