{"id":"CVE-2026-12064","aliases":["ALPINE-CVE-2026-12064","AZL-91812","BELL-CVE-2026-12064","CURL-CVE-2026-12064","DEBIAN-CVE-2026-12064","EUVD-2026-41502","GHSA-jm94-9f7h-36pr","JLSEC-2026-1202","OESA-2026-2986","OESA-2026-2987","OESA-2026-2988","RHSA-2026:29017","RHSA-2026:34975","RHSA-2026:55450","RHSA-2026:72506","ROOT-OS-ALPINE-315-CVE-2026-12064","ROOT-OS-ALPINE-317-CVE-2026-12064","ROOT-OS-ALPINE-320-CVE-2026-12064","ROOT-OS-ALPINE-321-CVE-2026-12064","ROOT-OS-ALPINE-322-CVE-2026-12064","ROOT-OS-ALPINE-323-CVE-2026-12064","ROOT-OS-DEBIAN-11-CVE-2026-12064","ROOT-OS-DEBIAN-12-CVE-2026-12064","ROOT-OS-DEBIAN-13-CVE-2026-12064","SUSE-SU-2026:22553-1","SUSE-SU-2026:22582-1","SUSE-SU-2026:22709-1","SUSE-SU-2026:22889-1","SUSE-SU-2026:2925-1","SUSE-SU-2026:2926-1","SUSE-SU-2026:3043-1","SUSE-SU-2026:5068-1","SUSE-SU-2026:5069-1","SUSE-SU-2026:5071-1","UBUNTU-CVE-2026-12064","openSUSE-SU-2026:11230-1","openSUSE-SU-2026:21272-1"],"status":"published","title":"proto-default skips SSH verification","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00414,"percentile":0.36154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295","CWE-297"],"published":"2026-06-24T08:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.11.1-10"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.21.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.21.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.21.0+0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"curl","fixed_in":["8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"rootio-curl","fixed_in":["8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"curl","fixed_in":["8.14.1-r20076","8.14.1-r20077","8.14.1-r20078","8.14.1-r20079","8.14.1-r200710","8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-curl","fixed_in":["8.14.1-r20076","8.14.1-r20077","8.14.1-r20078","8.14.1-r20079","8.14.1-r200710","8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"curl","fixed_in":["8.14.1-r20071","8.14.1-r20072","8.14.1-r20073","8.14.1-r30078","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-curl","fixed_in":["8.14.1-r20071","8.14.1-r20072","8.14.1-r20073","8.14.1-r30078","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"curl","fixed_in":["8.14.1-r20073","8.14.1-r20074","8.14.1-r400710","8.14.1-r30075","8.14.1-r30076","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"rootio-curl","fixed_in":["8.14.1-r20073","8.14.1-r20074","8.14.1-r400710","8.14.1-r30075","8.14.1-r30076","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-curl","fixed_in":["7.74.0-1.3+deb11u16.root.io.15","7.74.0-1.3+deb11u16.root.io.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"curl","fixed_in":["7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-curl","fixed_in":["7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u7.aikido.24","8.14.1-2+deb13u7.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-curl","fixed_in":["8.14.1-2+deb13u7.aikido.24","8.14.1-2+deb13u7.aikido.25"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"curl","fixed_in":["8.14.1-2ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"curl","fixed_in":["8.18.0-1ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.81.0"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.81.0"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.1-10"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u11","7.88.1-10+deb12u12","7.88.1-10+deb12u13","7.88.1-10+deb12u14","7.88.1-10+deb12u15","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6","7.88.1-10+deb12u6~bpo11+1","7.88.1-10+deb12u7","7.88.1-10+deb12u8","7.88.1-10+deb12u9","7.88.1-11","8.0.1-1~exp1","8.10.0-1","8.10.0-2","8.10.1-1","8.10.1-1~bpo12+1","8.10.1-2","8.11.0-1","8.11.1-1","8.11.1-1~bpo12+1","8.12.0+git20250209.89ed161+ds-1","8.12.0+git20250209.89ed161+ds-1~bpo12+1","8.12.1-1","8.12.1-2","8.12.1-2~bpo12+1","8.12.1-3","8.12.1-3~bpo12+1","8.13.0-1","8.13.0-1+exp1","8.13.0-2","8.13.0-2+exp1","8.13.0-3","8.13.0-4","8.13.0-4+exp1","8.13.0-5","8.13.0-5+exp1","8.13.0-5~bpo12+1","8.13.0~rc-1~exp1","8.13.0~rc-1~exp2","8.13.0~rc2-1","8.13.0~rc2-2","8.13.0~rc3-1","8.13.0~rc3-1+exp1","8.14.0-1","8.14.0-1+exp1","8.14.0~rc1-1+exp1","8.14.0~rc2-1+exp1","8.14.0~rc3-1+exp1","8.14.1-1","8.14.1-1~bpo12+1","8.14.1-2","8.14.1-2+exp1","8.14.1-2~bpo12+1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.2.1-1","8.2.1-2","8.2.1-2~bpo12+1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1","8.3.0-1","8.3.0-2","8.3.0-2~bpo12+1","8.3.0-2~exp1","8.3.0-3","8.4.0-1","8.4.0-2","8.4.0-2~bpo12+1","8.5.0-1","8.5.0-1+exp1","8.5.0-2","8.5.0-2+exp1","8.5.0-2~bpo12+1","8.6.0-1","8.6.0-1.1","8.6.0-2","8.6.0-3","8.6.0-3.1","8.6.0-3.1~exp1","8.6.0-3.1~exp2","8.6.0-3.2","8.6.0-4","8.7.1-1","8.7.1-1+exp1","8.7.1-2","8.7.1-3","8.7.1-4","8.7.1-5","8.7.1-5+exp1","8.7.1-5~bpo12+1","8.8.0-1","8.8.0-1+exp1","8.8.0-1+exp2","8.8.0-1~bpo12+1","8.8.0-2","8.8.0-3","8.8.0-4","8.9.0-1","8.9.0-2","8.9.0-3","8.9.1-1","8.9.1-2","8.9.1-2~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.1-2","8.14.1-2+deb13u1","8.14.1-2+deb13u2","8.14.1-2+deb13u2~bpo13+1","8.14.1-2+deb13u3","8.14.1-2+deb13u4","8.14.1-2+deb13u5","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.21.0~rc3-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1"]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.21.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.81.0+0"},{"fixed":"8.21.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-32.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-32.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-32.oe2403sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-none-softfloat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-i686-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-wasip1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-none","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r20078"},{"fixed":"8.14.1-r20079"},{"fixed":"8.14.1-r200710"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r20078"},{"fixed":"8.14.1-r20079"},{"fixed":"8.14.1-r200710"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30075"},{"fixed":"8.14.1-r30076"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30075"},{"fixed":"8.14.1-r30076"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.root.io.15"},{"fixed":"7.74.0-1.3+deb11u16.root.io.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u7.aikido.24"},{"fixed":"8.14.1-2+deb13u7.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u7.aikido.24"},{"fixed":"8.14.1-2+deb13u7.aikido.25"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-7.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150700.7.20.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.46.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.46.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.22.0-150700.7.33.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.22.0-150600.4.58.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.22.0-150600.4.58.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.134.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.134.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.5"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1","8.14.1-2ubuntu1.1","8.14.1-2ubuntu1.2","8.14.1-2ubuntu1.3","8.14.1-2ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.3"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1","8.18.0-1ubuntu2","8.18.0-1ubuntu2.1","8.18.0-1ubuntu2.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.21.0-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-12064.json","tags":["Vendor Advisory","web","article"]},{"url":"https://curl.se/docs/CVE-2026-12064.html","tags":["Patch","Vendor Advisory","web","article"]},{"url":"https://hackerone.com/reports/3797526","tags":["exploit","Exploit","Issue Tracking","Third Party Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jm94-9f7h-36pr","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-12064","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-12064","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12064.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-12064","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2987","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2988","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29017","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12064","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8286","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11352","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11586","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9079","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8926","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9546","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8927","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8925","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11564","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9080","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8458","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11856","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8924","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8932","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9547","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29017.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8286","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8286.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8286.json","tags":["article"]},{"url":"https://hackerone.com/reports/3718195","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496764","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8458.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8458.json","tags":["article"]},{"url":"https://hackerone.com/reports/3721183","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496765","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8924","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8924.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8924.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733905","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8925.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8925.json","tags":["article"]},{"url":"https://hackerone.com/reports/3735193","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496760","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8926.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8926.json","tags":["article"]},{"url":"https://hackerone.com/reports/3735184","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496769","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8927","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8927.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8927.json","tags":["article"]},{"url":"https://hackerone.com/reports/3744543","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8932.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8932.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733910","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496771","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9079.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9079.json","tags":["article"]},{"url":"https://hackerone.com/reports/3750295","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9080.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9080.json","tags":["article"]},{"url":"https://hackerone.com/reports/3749204","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496770","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9546.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9546.json","tags":["article"]},{"url":"https://hackerone.com/reports/3754343","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496758","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9547","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9547.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9547.json","tags":["article"]},{"url":"https://hackerone.com/reports/3751712","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496757","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11352","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11352.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11352.json","tags":["article"]},{"url":"https://hackerone.com/reports/3783438","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11564","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11564.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11564.json","tags":["article"]},{"url":"https://hackerone.com/reports/3788984","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496753","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11586","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11586.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11586.json","tags":["article"]},{"url":"https://hackerone.com/reports/3788931","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11856.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11856.json","tags":["article"]},{"url":"https://hackerone.com/reports/3793260","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12064","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34975","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-38969","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14683","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14685","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14686","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14684","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59870","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59868","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15187","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34975.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497102","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14683","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/","tags":["article"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/219","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14683","tags":["article"]},{"url":"https://vuldb.com/submit/846750","tags":["article"]},{"url":"https://vuldb.com/submit/846752","tags":["article"]},{"url":"https://vuldb.com/vuln/376279","tags":["article"]},{"url":"https://vuldb.com/vuln/376279/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14684","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/220","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14684","tags":["article"]},{"url":"https://vuldb.com/submit/846754","tags":["article"]},{"url":"https://vuldb.com/vuln/376280","tags":["article"]},{"url":"https://vuldb.com/vuln/376280/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497101","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14685","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/221","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14685","tags":["article"]},{"url":"https://vuldb.com/submit/846761","tags":["article"]},{"url":"https://vuldb.com/vuln/376281","tags":["article"]},{"url":"https://vuldb.com/vuln/376281/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14686","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/222","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14686","tags":["article"]},{"url":"https://vuldb.com/submit/846762","tags":["article"]},{"url":"https://vuldb.com/vuln/376282","tags":["article"]},{"url":"https://vuldb.com/vuln/376282/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15187","tags":["advisory"]},{"url":"https://github.com/enquirer/enquirer/","tags":["article"]},{"url":"https://github.com/enquirer/enquirer/issues/487","tags":["article"]},{"url":"https://github.com/enquirer/enquirer/issues/487#issuecomment-4648521328","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-15187","tags":["article"]},{"url":"https://vuldb.com/submit/851357","tags":["article"]},{"url":"https://vuldb.com/vuln/377113","tags":["article"]},{"url":"https://vuldb.com/vuln/377113/cti","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-38969","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59868","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59870","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55450","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446450","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55450.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14819","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14819","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14819.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1965","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1965","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-1965.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-1965.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/2","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3783.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3783.json","tags":["article"]},{"url":"https://hackerone.com/reports/3583983","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3784","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/3","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.json","tags":["article"]},{"url":"https://hackerone.com/reports/3584903","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72506","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72506.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622553-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268402","tags":["report"]},{"url":"https://bugzilla.suse.com/1268407","tags":["report"]},{"url":"https://bugzilla.suse.com/1268409","tags":["report"]},{"url":"https://bugzilla.suse.com/1268413","tags":["report"]},{"url":"https://bugzilla.suse.com/1268415","tags":["report"]},{"url":"https://bugzilla.suse.com/1268416","tags":["report"]},{"url":"https://bugzilla.suse.com/1268417","tags":["report"]},{"url":"https://bugzilla.suse.com/1268420","tags":["report"]},{"url":"https://bugzilla.suse.com/1268422","tags":["report"]},{"url":"https://bugzilla.suse.com/1268427","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9547","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622582-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622709-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622889-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262925-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262631","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4873","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262926-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263043-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265068-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268414","tags":["report"]},{"url":"https://bugzilla.suse.com/1268419","tags":["report"]},{"url":"https://bugzilla.suse.com/1268423","tags":["report"]},{"url":"https://bugzilla.suse.com/1268424","tags":["report"]},{"url":"https://bugzilla.suse.com/1268425","tags":["report"]},{"url":"https://bugzilla.suse.com/1268426","tags":["report"]},{"url":"https://bugzilla.suse.com/1277477","tags":["report"]},{"url":"https://bugzilla.suse.com/1277478","tags":["report"]},{"url":"https://bugzilla.suse.com/1277482","tags":["report"]},{"url":"https://bugzilla.suse.com/1278173","tags":["report"]},{"url":"https://bugzilla.suse.com/1285008","tags":["report"]},{"url":"https://bugzilla.suse.com/1285010","tags":["report"]},{"url":"https://bugzilla.suse.com/1285011","tags":["report"]},{"url":"https://bugzilla.suse.com/1285012","tags":["report"]},{"url":"https://bugzilla.suse.com/1285013","tags":["report"]},{"url":"https://bugzilla.suse.com/1285014","tags":["report"]},{"url":"https://bugzilla.suse.com/1285015","tags":["report"]},{"url":"https://bugzilla.suse.com/1285016","tags":["report"]},{"url":"https://bugzilla.suse.com/1285017","tags":["report"]},{"url":"https://bugzilla.suse.com/1285018","tags":["report"]},{"url":"https://bugzilla.suse.com/1285021","tags":["report"]},{"url":"https://bugzilla.suse.com/1285022","tags":["report"]},{"url":"https://bugzilla.suse.com/1285023","tags":["report"]},{"url":"https://bugzilla.suse.com/1285024","tags":["report"]},{"url":"https://bugzilla.suse.com/1285026","tags":["report"]},{"url":"https://bugzilla.suse.com/1285027","tags":["report"]},{"url":"https://bugzilla.suse.com/1285028","tags":["report"]},{"url":"https://bugzilla.suse.com/1285029","tags":["report"]},{"url":"https://bugzilla.suse.com/1285030","tags":["report"]},{"url":"https://bugzilla.suse.com/1285031","tags":["report"]},{"url":"https://bugzilla.suse.com/1287781","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9546","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265069-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265071-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12064","tags":["report"]},{"url":"https://curl.se/L7HzKXisfJ/CVE-2026-12064.md","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8525-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8926","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-12064","title":"proto-default skips SSH verification","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.","status":"published","published":"2026-07-03T06:13:55.302Z","modified":"2026-09-15T06:02:44.283Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-41502","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.","status":"published","published":"2026-07-03T06:13:55Z","modified":"2026-09-15T06:02:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-jm94-9f7h-36pr","title":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a...","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.","status":"published","published":"2026-07-03T09:31:26Z","modified":"2026-09-15T09:31:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-295","CWE-297"],"updated_at":"2026-11-02T15:11:53.5286Z"}],"nvd":[{"id":"CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.","status":"published","published":"2026-07-03T07:16:24.217Z","modified":"2026-09-15T07:16:26.15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-297","CWE-295"],"updated_at":"2026-11-02T14:12:27.541515Z"}],"osv":[{"id":"ALPINE-CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.","status":"published","published":"2026-07-03T07:16:24.217Z","modified":"2026-10-01T02:17:49.173846024Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-12064","status":"published","published":"2026-06-26T06:12:35.728467Z","modified":"2026-07-08T07:15:04.435011397Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-12064","title":"proto-default skips SSH verification","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.","status":"published","published":"2026-07-03T06:13:55.302Z","modified":"2026-11-03T22:56:57.579130005Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-297"],"updated_at":"2026-11-03T23:33:37.216034Z"},{"id":"DEBIAN-CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.","status":"published","published":"2026-07-03T07:16:24.217Z","modified":"2026-10-01T03:01:55.18042723Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"JLSEC-2026-1202","title":"When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a...","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\n`CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256` and `CURLOPT_SSH_KNOWNHOSTS`. Conversely, the\nlibcurl runtime successfully honors `CURLOPT_DEFAULT_PROTOCOL` and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.","status":"published","published":"2026-08-07T20:11:58.984Z","modified":"2026-08-07T20:28:39.670508447Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2986","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.(CVE-2026-10536)\n\nWhen a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.(CVE-2026-12064)\n\nA vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.(CVE-2026-8286)\n\nA flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\u0026apos;super cookies\u0026apos; that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.(CVE-2026-8924)\n\nWhen reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.(CVE-2026-8927)\n\nWhen a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)","status":"published","published":"2026-07-19T11:11:53Z","modified":"2026-08-18T01:21:17.778116902Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2987","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.(CVE-2026-10536)\n\nWhen a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.(CVE-2026-12064)\n\nA vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.(CVE-2026-8286)\n\nA flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\u0026apos;super cookies\u0026apos; that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.(CVE-2026-8924)\n\nWhen reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.(CVE-2026-8927)\n\nWhen a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)","status":"published","published":"2026-07-19T11:11:53Z","modified":"2026-08-18T01:21:18.083392891Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2988","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.(CVE-2026-10536)\n\nWhen a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.(CVE-2026-12064)\n\nA vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.(CVE-2026-8286)\n\nA flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\u0026apos;super cookies\u0026apos; that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.(CVE-2026-8924)\n\nWhen reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.(CVE-2026-8927)\n\nWhen a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)","status":"published","published":"2026-07-19T11:11:53Z","modified":"2026-08-18T01:21:18.030205234Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:29017","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-16T10:07:43Z","modified":"2026-10-17T10:11:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:34975","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-04T10:07:59Z","modified":"2026-10-17T10:12:31Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:55450","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-08-17T10:17:02Z","modified":"2026-10-16T10:20:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:72506","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-09-29T10:18:29Z","modified":"2026-10-16T10:24:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.","status":"published","published":"2026-06-24T14:00:00Z","modified":"2026-07-11T00:15:06.070774876Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:00.081948Z"},{"id":"AZL-91812","title":"CVE-2026-12064 affecting package curl for versions less than 8.11.1-10","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.","status":"published","published":"2026-07-03T07:16:24Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CURL-CVE-2026-12064","title":"proto-default skips SSH verification","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.","status":"published","published":"2026-06-24T08:00:00Z","modified":"2026-10-25T01:05:22.532869124Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2026:11230-1","title":"curl-8.21.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.392224841Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21272-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-08T13:46:40Z","modified":"2026-07-11T18:24:39.683959322Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2026-12064","title":"CVE-2026-12064 in curl - Patched by Root","description":"Root has patched CVE-2026-12064 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-11-04T10:54:49Z","modified":"2026-11-04T11:15:03.012344883Z","updated_at":"2026-11-04T11:38:21.953745Z"},{"id":"ROOT-OS-ALPINE-317-CVE-2026-12064","title":"CVE-2026-12064 in curl - Patched by Root","description":"Root has patched CVE-2026-12064 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.","status":"published","published":"2026-11-04T16:15:55Z","modified":"2026-11-04T17:15:39.506010425Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-12064","title":"CVE-2026-12064 in curl - Patched by Root","description":"Root has patched CVE-2026-12064 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:40:45Z","modified":"2026-09-29T10:15:18.517329708Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-12064","title":"CVE-2026-12064 in curl - Patched by Root","description":"Root has patched CVE-2026-12064 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-11-03T11:37:01Z","modified":"2026-11-03T12:15:07.06156313Z","updated_at":"2026-11-03T12:31:35.467775Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2026-12064","title":"CVE-2026-12064 in curl - Patched by Root","description":"Root has patched CVE-2026-12064 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.","status":"published","published":"2026-10-19T06:56:08Z","modified":"2026-10-19T07:15:07.075790452Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-323-CVE-2026-12064","title":"CVE-2026-12064 in curl - Patched by Root","description":"Root has patched CVE-2026-12064 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-11T14:25:22Z","modified":"2026-10-09T13:00:09.082235351Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-12064","title":"CVE-2026-12064 in rootio-curl - Patched by Root","description":"Root has patched CVE-2026-12064 in the rootio-curl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-07-14T07:05:17Z","modified":"2026-07-28T19:39:31.50653308Z","updated_at":"2026-11-02T15:53:29.631993Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-12064","title":"CVE-2026-12064 in curl - Patched by Root","description":"Root has patched CVE-2026-12064 in the curl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-04T06:00:50Z","modified":"2026-11-04T07:15:07.978805048Z","updated_at":"2026-11-04T07:32:10.855619Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-12064","title":"CVE-2026-12064 in curl - Patched by Root","description":"Root has patched CVE-2026-12064 in the curl package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-11-03T10:50:30Z","modified":"2026-11-03T11:15:10.529864019Z","updated_at":"2026-11-03T11:30:16.221977Z"},{"id":"SUSE-SU-2026:22553-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-08T13:46:31Z","modified":"2026-07-14T18:24:37.508643741Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22582-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-08T13:46:31Z","modified":"2026-07-15T18:24:12.557773119Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22709-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-14T12:55:28Z","modified":"2026-07-23T18:24:15.490752267Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22889-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-21T16:53:33Z","modified":"2026-07-28T18:24:18.578169362Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2925-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-13T17:53:28Z","modified":"2026-07-15T10:00:04.814454459Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2926-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-13T17:55:13Z","modified":"2026-07-15T10:00:04.824336179Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3043-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-15T11:51:36Z","modified":"2026-07-16T10:00:08.029752736Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:5068-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).\n- CVE-2026-9546: sending old referer (bsc#1268419).\n- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).\n- CVE-2026-11564: Native CA trust persist (bsc#1268424).\n- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).\n- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).\n- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).\n- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).\n- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).\n- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).\n- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).\n- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).\n- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).\n- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).\n- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).\n- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).\n- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).\n- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).\n- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).\n- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).\n- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).\n- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).\n- CVE-2026-92389: TFTP direction confusion (bsc#1285015).\n- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).\n- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).\n- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).\n- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).\n- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).\n- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).\n  \nChanges for curl:\n\n- Updated curl to version 8.22.0. (jsc#PED-16984)\n","status":"published","published":"2026-11-03T08:13:17Z","modified":"2026-11-03T22:45:04.218292646Z","updated_at":"2026-11-03T22:59:30.419462Z"},{"id":"SUSE-SU-2026:5069-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).\n- CVE-2026-9546: sending old referer (bsc#1268419).\n- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).\n- CVE-2026-11564: Native CA trust persist (bsc#1268424).\n- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).\n- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).\n- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).\n- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).\n- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).\n- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).\n- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).\n- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).\n- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).\n- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).\n- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).\n- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).\n- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).\n- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).\n- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).\n- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).\n- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).\n- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).\n- CVE-2026-92389: TFTP direction confusion (bsc#1285015).\n- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).\n- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).\n- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).\n- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).\n- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).\n- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).\n\nChanges for curl:\n\n- Updated to version 8.22.0. (jsc#PED-16984)\n","status":"published","published":"2026-11-03T08:13:44Z","modified":"2026-11-03T22:45:05.964085219Z","updated_at":"2026-11-03T22:59:30.419462Z"},{"id":"SUSE-SU-2026:5071-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).\n- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).\n- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).\n- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).\n- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).\n- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).\n- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).\n- CVE-2026-92389: TFTP direction confusion (bsc#1285015).\n- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).\n- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).\n","status":"published","published":"2026-11-03T08:14:35Z","modified":"2026-11-03T22:45:03.520972957Z","updated_at":"2026-11-03T22:59:30.419462Z"}]}}