{"id":"CVE-2026-3783","aliases":["ALPINE-CVE-2026-3783","ALSA-2026:55439","AZL-79673","BELL-CVE-2026-3783","CLSA-2026-1773938530","CLSA-2026-1773939685","CLSA-2026-1774259220","CLSA-2026-1774259901","CLSA-2026-1774260216","CLSA-2026-1774366368","CURL-CVE-2026-3783","DEBIAN-CVE-2026-3783","EUVD-2026-11138","GHSA-8whr-249c-vfjp","JLSEC-2026-437","OESA-2026-1704","RHSA-2026:55439","RHSA-2026:55450","RHSA-2026:6893","RHSA-2026:72506","RHSA-2026:7432","RHSA-2026:77255","RLSA-2026:55439","ROOT-OS-DEBIAN-11-CVE-2026-3783","ROOT-OS-DEBIAN-12-CVE-2026-3783","ROOT-OS-DEBIAN-13-CVE-2026-3783","SUSE-SU-2026:0879-1","SUSE-SU-2026:0885-1","SUSE-SU-2026:0903-1","SUSE-SU-2026:0911-1","SUSE-SU-2026:0921-1","SUSE-SU-2026:20668-1","SUSE-SU-2026:20722-1","SUSE-SU-2026:20760-1","SUSE-SU-2026:20918-1","UBUNTU-CVE-2026-3783","USN-8084-1","USN-8099-1","openSUSE-SU-2026:10371-1","openSUSE-SU-2026:20404-1"],"status":"published","title":"token leak with redirect and netrc","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00495,"percentile":0.42741,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-522"],"published":"2026-03-11T08:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.14.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.19.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.11.1-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.19.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.19.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl-minimal","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-devel","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-minimal","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.88.1-10+deb12u15"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.19.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.20.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.19.0+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"curl","fixed_in":["7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17","7.74.0-1.3+deb11u16.root.io.15","7.74.0-1.3+deb11u16.root.io.16","7.74.0-1.3+deb11u16.root.io.14"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-curl","fixed_in":["7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17","7.74.0-1.3+deb11u16.root.io.15","7.74.0-1.3+deb11u16.root.io.16","7.74.0-1.3+deb11u16.root.io.14"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-curl","fixed_in":["7.88.1-10+deb12u14.root.io.11","7.88.1-10+deb12u14.root.io.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.25+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"curl","fixed_in":["7.81.0-1ubuntu1.23"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"curl","fixed_in":["8.5.0-2ubuntu10.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"curl","fixed_in":["8.14.1-2ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"curl","fixed_in":["8.18.0-1ubuntu2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"curl","fixed_in":["8.18.0-1ubuntu2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.33.0"},{"fixed":"8.14.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.33.0"},{"fixed":"8.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.33.0"},{"fixed":"8.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.33.0"},{"fixed":"8.19.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.1-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.19.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.19.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl3-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl3-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-gnutls-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-nss-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-openssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u15"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u11","7.88.1-10+deb12u12","7.88.1-10+deb12u13","7.88.1-10+deb12u14","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6","7.88.1-10+deb12u6~bpo11+1","7.88.1-10+deb12u7","7.88.1-10+deb12u8","7.88.1-10+deb12u9"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u4"}]}],"versions":["8.14.1-2","8.14.1-2+deb13u1","8.14.1-2+deb13u2","8.14.1-2+deb13u2~bpo13+1","8.14.1-2+deb13u3"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.0-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1~bpo13+1","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1"]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.20.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.19.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-47.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-48.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-28.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-28.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-28.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-28.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-40.el9_8.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Debian:11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"},{"fixed":"7.74.0-1.3+deb11u16.root.io.15"},{"fixed":"7.74.0-1.3+deb11u16.root.io.16"},{"fixed":"7.74.0-1.3+deb11u16.root.io.14"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"},{"fixed":"7.74.0-1.3+deb11u16.root.io.15"},{"fixed":"7.74.0-1.3+deb11u16.root.io.16"},{"fixed":"7.74.0-1.3+deb11u16.root.io.14"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u14.root.io.11"},{"fixed":"7.88.1-10+deb12u14.root.io.10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.103.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150700.7.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.120.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.120.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.25+esm3"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15","7.68.0-1ubuntu2.16","7.68.0-1ubuntu2.18","7.68.0-1ubuntu2.19","7.68.0-1ubuntu2.20","7.68.0-1ubuntu2.21","7.68.0-1ubuntu2.22","7.68.0-1ubuntu2.23","7.68.0-1ubuntu2.24","7.68.0-1ubuntu2.25","7.68.0-1ubuntu2.25+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.23"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15","7.81.0-1ubuntu1.16","7.81.0-1ubuntu1.17","7.81.0-1ubuntu1.18","7.81.0-1ubuntu1.19","7.81.0-1ubuntu1.20","7.81.0-1ubuntu1.21","7.81.0-1ubuntu1.22"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.8"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6","8.5.0-2ubuntu10.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.2"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1","8.14.1-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.23"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15","7.81.0-1ubuntu1.16","7.81.0-1ubuntu1.17","7.81.0-1ubuntu1.18","7.81.0-1ubuntu1.19","7.81.0-1ubuntu1.20","7.81.0-1ubuntu1.21","7.81.0-1ubuntu1.22"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.8"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6","8.5.0-2ubuntu10.7"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.2"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1","8.14.1-2ubuntu1.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+esm8"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16","7.58.0-2ubuntu3.17","7.58.0-2ubuntu3.18","7.58.0-2ubuntu3.19","7.58.0-2ubuntu3.20","7.58.0-2ubuntu3.21","7.58.0-2ubuntu3.22","7.58.0-2ubuntu3.23","7.58.0-2ubuntu3.24","7.58.0-2ubuntu3.24+esm1","7.58.0-2ubuntu3.24+esm2","7.58.0-2ubuntu3.24+esm3","7.58.0-2ubuntu3.24+esm4","7.58.0-2ubuntu3.24+esm5","7.58.0-2ubuntu3.24+esm7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.25+esm3"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15","7.68.0-1ubuntu2.16","7.68.0-1ubuntu2.18","7.68.0-1ubuntu2.19","7.68.0-1ubuntu2.20","7.68.0-1ubuntu2.21","7.68.0-1ubuntu2.22","7.68.0-1ubuntu2.23","7.68.0-1ubuntu2.24","7.68.0-1ubuntu2.25","7.68.0-1ubuntu2.25+esm2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.0-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.5.1"}]}],"bundled":4}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-3783.json","tags":["Vendor Advisory","web","article"]},{"url":"https://curl.se/docs/CVE-2026-3783.html","tags":["Patch","Vendor Advisory","web","article","report"]},{"url":"https://hackerone.com/reports/3583983","tags":["Exploit","Issue Tracking","Third Party Advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/2","tags":["Mailing List","Third Party Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8whr-249c-vfjp","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-3783","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55439","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1965","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3783","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8286","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9547","tags":["report"]},{"url":"https://bugzilla.redhat.com/2446448","tags":["report"]},{"url":"https://bugzilla.redhat.com/2446450","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496758","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496763","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-55439.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-3783","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1773938530.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1773939685.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1774259220.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1774259901.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1774260216.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1774366368.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3783.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-3783","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496758","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496763","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55439.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1965","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-1965.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-1965.json","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3783","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8286.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8286.json","tags":["article"]},{"url":"https://hackerone.com/reports/3718195","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9547.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9547.json","tags":["article"]},{"url":"https://hackerone.com/reports/3751712","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55450","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496768","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55450.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14819","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14819","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14819.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3784","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3784","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/3","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.json","tags":["article"]},{"url":"https://hackerone.com/reports/3584903","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12064","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-12064.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-12064.json","tags":["article"]},{"url":"https://hackerone.com/reports/3797526","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6893","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9086","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10148","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10966","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15224","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15079","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14524","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13034","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3805","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14017","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6893.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2394750","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9086","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-9086.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-9086.json","tags":["article"]},{"url":"https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6","tags":["article"]},{"url":"https://hackerone.com/reports/3294999","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2394749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10148","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-10148.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-10148.json","tags":["article"]},{"url":"https://hackerone.com/reports/3330839","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2413308","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10966","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10966","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/11/05/2","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-10966.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-10966.json","tags":["article"]},{"url":"https://github.com/curl/curl/commit/b011e3fcfb06d6c027859","tags":["article"]},{"url":"https://hackerone.com/reports/3355218","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426406","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427870","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14017","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14017.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-14017.json","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14524","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426410","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446451","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3805","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3805","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/4","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3805.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3805.json","tags":["article"]},{"url":"https://hackerone.com/reports/3591944","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72506","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496764","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496765","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496769","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496771","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72506.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8458","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8458.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8458.json","tags":["article"]},{"url":"https://hackerone.com/reports/3721183","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8924","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8924.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8924.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733905","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8926.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8926.json","tags":["article"]},{"url":"https://hackerone.com/reports/3735184","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8927.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8927.json","tags":["article"]},{"url":"https://hackerone.com/reports/3744543","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8932","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8932.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8932.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733910","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9079","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9079.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9079.json","tags":["article"]},{"url":"https://hackerone.com/reports/3750295","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11856","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11856.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11856.json","tags":["article"]},{"url":"https://hackerone.com/reports/3793260","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7432","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7432.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:77255","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77255.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55439","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260879-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259362","tags":["report"]},{"url":"https://bugzilla.suse.com/1259363","tags":["report"]},{"url":"https://bugzilla.suse.com/1259364","tags":["report"]},{"url":"https://bugzilla.suse.com/1259365","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3805","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260885-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260903-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260911-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260921-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620668-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620722-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620760-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620918-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-3783","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8084-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8099-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-0167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-1965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-3784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-3805","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-3783","title":"token leak with redirect and netrc","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-03-11T10:09:08.746Z","modified":"2026-09-15T06:02:52.569Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-522","CWE-522"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-11138","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-03-11T10:09:08Z","modified":"2026-09-15T06:02:52Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-8whr-249c-vfjp","title":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a...","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-03-11T12:31:22Z","modified":"2026-03-11T15:32:59Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:06:34.428268Z"}],"nvd":[{"id":"CVE-2026-3783","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-03-11T11:16:00.08Z","modified":"2026-09-15T07:16:27.72Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:12:08.98071Z"}],"osv":[{"id":"ALPINE-CVE-2026-3783","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-03-11T11:16:00.08Z","modified":"2026-10-18T12:30:04.040673612Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-3783","status":"published","published":"2026-03-13T06:08:18.868252Z","modified":"2026-03-17T07:54:11.211801Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-3783","title":"token leak with redirect and netrc","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-03-11T10:09:08.746Z","modified":"2026-10-28T11:12:16.261784729Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"DEBIAN-CVE-2026-3783","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances.  If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-03-11T11:16:00.08Z","modified":"2026-10-01T03:03:22.629945892Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"JLSEC-2026-437","title":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect...","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-25T18:24:26.025053722Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-1704","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nlibcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it just sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with  `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl\u0026apos;s reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API).(CVE-2026-1965)\n\nWhen an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.(CVE-2026-3783)\n\ncurl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.(CVE-2026-3784)","status":"published","published":"2026-03-20T11:10:44Z","modified":"2026-08-18T01:19:42.071191179Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"RHSA-2026:55439","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-08-17T10:16:57Z","modified":"2026-10-16T10:20:08Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55450","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-08-17T10:17:02Z","modified":"2026-10-16T10:20:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:6893","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:10:50Z","modified":"2026-10-16T10:23:46Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:72506","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-09-29T10:18:29Z","modified":"2026-10-16T10:24:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7432","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-16T10:25:26Z","modified":"2026-10-16T10:30:36.253688398Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:77255","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-14T10:31:04Z","modified":"2026-10-16T10:26:01Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:55439","title":"Important: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication (CVE-2026-1965)\n\n* curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect (CVE-2026-3783)\n\n* curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)\n\n* curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-17T18:03:57.407277Z","modified":"2026-08-17T18:30:03.416244981Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-3783","title":"CVE-2026-3783 in curl - Patched by Root","description":"Root has patched CVE-2026-3783 in the curl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T12:49:54Z","modified":"2026-08-20T13:30:11.498859098Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-3783","title":"CVE-2026-3783 in rootio-curl - Patched by Root","description":"Root has patched CVE-2026-3783 in the rootio-curl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-07-09T08:22:17Z","modified":"2026-07-28T19:37:16.820732405Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-3783","title":"CVE-2026-3783 in rootio-curl - Patched by Root","description":"Root has patched CVE-2026-3783 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-07-10T15:43:44Z","modified":"2026-07-13T14:00:21.248002279Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"UBUNTU-CVE-2026-3783","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-03-11T18:00:00Z","modified":"2026-10-17T12:58:13.539282618Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"ALSA-2026:55439","title":"Important: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  \n\nSecurity Fix(es):  \n\n  * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication (CVE-2026-1965)\n  * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect (CVE-2026-3783)\n  * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)\n  * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:32:24.135471193Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-79673","title":"CVE-2026-3783 affecting package curl for versions less than 8.11.1-6","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-03-11T11:16:00Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1773938530","title":"curl: Fix of CVE-2026-3783","description":"- CVE-2026-3783: prevent bearer token leak on HTTP(S) redirect when .netrc\n  contains entries for the redirected host","status":"published","published":"2026-03-19T16:42:20Z","modified":"2026-06-01T00:31:58.274451282Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773939685","title":"curl: Fix of CVE-2026-3783","description":"- CVE-2026-3783: prevent bearer token leak on HTTP(S) redirect when .netrc\n  contains entries for the redirected host","status":"published","published":"2026-03-26T09:31:51Z","modified":"2026-06-01T00:32:43.78535704Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774259220","title":"curl: Fix of 3 CVEs","description":"- CVE-2026-1965: fix incorrect connection reuse; prevent reuse of Negotiate-\n  authenticated connections with different credentials and require\n  authentication identity match\n- CVE-2026-3784: fix wrong proxy connection reuse with different credentials;\n  check proxy user/password in proxy_info_matches to prevent reuse of HTTP\n  proxy CONNECT connections when credentials differ\n- CVE-2026-3783: prevent bearer token leak on HTTP(S) redirect when .netrc\n  contains entries for the redirected host","status":"published","published":"2026-03-23T09:47:04Z","modified":"2026-10-21T10:47:58.456563304Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774259901","title":"curl: Fix of 3 CVEs","description":"- CVE-2026-1965: fix incorrect connection reuse; prevent reuse of Negotiate-\n  authenticated connections with different credentials and require\n  authentication identity match\n- CVE-2026-3784: fix wrong proxy connection reuse with different credentials;\n  check proxy user/password in proxy_info_matches to prevent reuse of HTTP\n  proxy CONNECT connections when credentials differ\n- CVE-2026-3783: prevent bearer token leak on HTTP(S) redirect when .netrc\n  contains entries for the redirected host","status":"published","published":"2026-03-23T09:58:29Z","modified":"2026-10-21T10:48:08.956843911Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774260216","title":"Fix CVE(s): CVE-2026-1965, CVE-2026-3783, CVE-2026-3784","description":"   * SECURITY UPDATE: reuse of connections using HTTP Negotiate\n     - debian/patches/CVE-2026-1965.patch: fix reuse of connections using\n       HTTP Negotiate and fix copy and paste url_match_auth_nego mistake.\n     - CVE-2026-1965\n   * Bearer token sent without checking auth is allowed\n     - debian/patches/CVE-2026-3783.patch: only send bearer if auth is\n       allowed.\n     - CVE-2026-3783\n   * Proxy credential reuse across different credentials\n     - debian/patches/CVE-2026-3784.patch: compare proxy credentials in\n       proxy_info_matches to prevent connection reuse with wrong auth.\n     - CVE-2026-3784","status":"published","published":"2026-03-23T10:03:44Z","modified":"2026-06-04T10:04:04.041223Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774366368","title":"curl: Fix of 3 CVEs","description":"- CVE-2026-1965: fix incorrect connection reuse; prevent reuse of Negotiate-\n  authenticated connections with different credentials and require\n  authentication identity match\n- CVE-2026-3784: fix wrong proxy connection reuse with different credentials;\n  check proxy user/password in proxy_info_matches to prevent reuse of HTTP\n  proxy CONNECT connections when credentials differ\n- CVE-2026-3783: prevent bearer token leak on HTTP(S) redirect when .netrc\n  contains entries for the redirected host","status":"published","published":"2026-03-24T15:32:53Z","modified":"2026-10-21T10:45:58.662655354Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CURL-CVE-2026-3783","title":"token leak with redirect and netrc","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","status":"published","published":"2026-03-11T08:00:00Z","modified":"2026-10-25T01:05:19.76755681Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2026:10371-1","title":"curl-8.19.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.19.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-14T00:00:00Z","modified":"2026-03-15T11:45:25.123527Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20404-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).\n- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).\n- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).\n- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).\n","status":"published","published":"2026-03-20T09:36:45Z","modified":"2026-03-29T17:25:00.057598Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0879-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).\n- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).\n- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).\n- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).\n","status":"published","published":"2026-03-12T10:04:20Z","modified":"2026-03-13T08:50:09.673568Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0885-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).\n- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).\n- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).\n- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).\n","status":"published","published":"2026-03-12T14:50:17Z","modified":"2026-03-13T08:51:12.24607Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0903-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).\n- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).\n- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).\n- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).\n","status":"published","published":"2026-03-17T10:04:47Z","modified":"2026-03-18T08:45:40.462062Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0911-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).\n- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).\n- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).\n- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).\n","status":"published","published":"2026-03-17T19:56:50Z","modified":"2026-03-19T08:45:07.296307Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0921-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).\n- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).\n- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).\n","status":"published","published":"2026-03-18T08:52:04Z","modified":"2026-03-19T08:45:07.020048Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20668-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).\n- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).\n- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).\n- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).\n","status":"published","published":"2026-03-12T10:04:10Z","modified":"2026-03-23T04:53:07.311083Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20722-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).\n- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).\n- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).\n- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).\n","status":"published","published":"2026-03-12T09:40:37Z","modified":"2026-03-23T04:53:09.181751Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20760-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).\n- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).\n- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).\n- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).\n","status":"published","published":"2026-03-20T09:37:16Z","modified":"2026-03-25T17:23:46.030906Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20918-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).\n- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).\n- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).\n- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).\n","status":"published","published":"2026-03-20T09:37:16Z","modified":"2026-04-02T17:24:02.443084Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-8084-1","title":"curl vulnerabilities","description":"Zhicheng Chen discovered that curl could incorrectly reuse the wrong\nconnection for Negotiate-authenticated HTTP or HTTPS requests. This could\nresult in the use of credentials from a different connection, contrary to\nexpectations. (CVE-2026-1965)\n\nIt was discovered that curl incorrectly leaked OAuth2 bearer tokens when\nfollowing a redirect. This could result in tokens being sent to the wrong\nhost, contrary to expectations. (CVE-2026-3783)\n\nMuhamad Arga Reksapati discovered that curl incorrectly reused existing\nHTTP proxy connections even if the request used different credentials. This\ncould result in the use of incorrect credentials, contrary to expectations.\n(CVE-2026-3784)\n\nDaniel Wade discovered that curl incorrectly handled certain memory\noperations when doing a second SMB request to the same host. An attacker\ncould use this issue to cause curl to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 25.10. (CVE-2026-3805)\n\nYihang Zhou discovered that curl incorrectly reused .netrc file credentials\nwhen following redirects. This could result in the use of credentials for\na different host, contrary to expectations. This issue only affected Ubuntu\n22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-0167)","status":"published","published":"2026-03-11T12:11:15Z","modified":"2026-04-27T18:47:20.575043315Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8099-1","title":"curl vulnerabilities","description":"Zhicheng Chen discovered that curl could incorrectly reuse the wrong\nconnection for Negotiate-authenticated HTTP or HTTPS requests. This could\nresult in the use of credentials from a different connection, contrary to\nexpectations. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-1965)\n\nIt was discovered that curl incorrectly leaked OAuth2 bearer tokens when\nfollowing a redirect. This could result in tokens being sent to the wrong\nhost, contrary to expectations. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2026-3783)\n\nMuhamad Arga Reksapati discovered that curl incorrectly reused existing\nHTTP proxy connections even if the request used different credentials. This\ncould result in the use of incorrect credentials, contrary to expectations.\n(CVE-2026-3784)","status":"published","published":"2026-03-16T17:35:41Z","modified":"2026-04-27T18:43:27.113532Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}