{"id":"CVE-2026-6276","aliases":["ALPINE-CVE-2026-6276","AZL-86655","AZL-86679","BELL-CVE-2026-6276","CLSA-2026-1779357790","CLSA-2026-1779358660","CLSA-2026-1785773934","CLSA-2026-1786119141","CLSA-2026-1792808992","CURL-CVE-2026-6276","DEBIAN-CVE-2026-6276","EUVD-2026-29928","GHSA-2jc6-hc33-hv48","JLSEC-2026-1207","OESA-2026-2451","OESA-2026-2452","OESA-2026-2453","OESA-2026-2454","OESA-2026-2477","RHSA-2026:12916","ROOT-OS-ALPINE-315-CVE-2026-6276","ROOT-OS-ALPINE-317-CVE-2026-6276","ROOT-OS-ALPINE-320-CVE-2026-6276","ROOT-OS-ALPINE-321-CVE-2026-6276","ROOT-OS-ALPINE-322-CVE-2026-6276","ROOT-OS-DEBIAN-11-CVE-2026-6276","ROOT-OS-DEBIAN-12-CVE-2026-6276","ROOT-OS-DEBIAN-13-CVE-2026-6276","SUSE-SU-2026:1717-1","SUSE-SU-2026:1940-1","SUSE-SU-2026:21452-1","SUSE-SU-2026:22146-1","SUSE-SU-2026:22156-1","SUSE-SU-2026:2703-1","SUSE-SU-2026:3798-1","UBUNTU-CVE-2026-6276","openSUSE-SU-2026:10674-1","openSUSE-SU-2026:20973-1"],"status":"published","title":"stale custom cookie host causes cookie leak","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00295,"percentile":0.22305,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-319","CWE-346"],"published":"2026-04-29T08:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.14.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.11.1-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-14"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"curl","fixed_in":["7.29.0-59.0.3.el7_9.2.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"libcurl","fixed_in":["7.29.0-59.0.3.el7_9.2.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"libcurl-devel","fixed_in":["7.29.0-59.0.3.el7_9.2.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"curl","fixed_in":["7.19.7-59.el6.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"libcurl","fixed_in":["7.19.7-59.el6.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"libcurl-devel","fixed_in":["7.19.7-59.el6.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.20.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.20.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.20.0+0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"curl","fixed_in":["8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"rootio-curl","fixed_in":["8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"curl","fixed_in":["8.14.1-r20078","8.14.1-r20079","8.14.1-r200710","8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-curl","fixed_in":["8.14.1-r20078","8.14.1-r20079","8.14.1-r200710","8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"curl","fixed_in":["8.14.1-r20071","8.14.1-r20072","8.14.1-r20073","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-curl","fixed_in":["8.14.1-r20071","8.14.1-r20072","8.14.1-r20073","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"curl","fixed_in":["8.14.1-r20072","8.14.1-r20071","8.14.1-r20073","8.14.1-r20074","8.14.1-r30075","8.14.1-r30076","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"rootio-curl","fixed_in":["8.14.1-r20072","8.14.1-r20071","8.14.1-r20073","8.14.1-r20074","8.14.1-r30075","8.14.1-r30076","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"curl","fixed_in":["7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17","7.74.0-1.3+deb11u16.root.io.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-curl","fixed_in":["7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17","7.74.0-1.3+deb11u16.root.io.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"curl","fixed_in":["7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-curl","fixed_in":["7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"curl","fixed_in":["7.81.0-1ubuntu1.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"curl","fixed_in":["8.5.0-2ubuntu10.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"curl","fixed_in":["8.14.1-2ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"curl","fixed_in":["8.18.0-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.71.0"},{"fixed":"8.14.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.71.0"},{"fixed":"8.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.71.0"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.71.0"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.1-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-14"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els11"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-59.0.3.el7_9.2.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-59.0.3.el7_9.2.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-59.0.3.el7_9.2.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl3-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl3-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-gnutls-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-nss-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libcurl4-openssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u11","7.88.1-10+deb12u12","7.88.1-10+deb12u13","7.88.1-10+deb12u14","7.88.1-10+deb12u15","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6","7.88.1-10+deb12u6~bpo11+1","7.88.1-10+deb12u7","7.88.1-10+deb12u8","7.88.1-10+deb12u9","7.88.1-11","8.0.1-1~exp1","8.10.0-1","8.10.0-2","8.10.1-1","8.10.1-1~bpo12+1","8.10.1-2","8.11.0-1","8.11.1-1","8.11.1-1~bpo12+1","8.12.0+git20250209.89ed161+ds-1","8.12.0+git20250209.89ed161+ds-1~bpo12+1","8.12.1-1","8.12.1-2","8.12.1-2~bpo12+1","8.12.1-3","8.12.1-3~bpo12+1","8.13.0-1","8.13.0-1+exp1","8.13.0-2","8.13.0-2+exp1","8.13.0-3","8.13.0-4","8.13.0-4+exp1","8.13.0-5","8.13.0-5+exp1","8.13.0-5~bpo12+1","8.13.0~rc-1~exp1","8.13.0~rc-1~exp2","8.13.0~rc2-1","8.13.0~rc2-2","8.13.0~rc3-1","8.13.0~rc3-1+exp1","8.14.0-1","8.14.0-1+exp1","8.14.0~rc1-1+exp1","8.14.0~rc2-1+exp1","8.14.0~rc3-1+exp1","8.14.1-1","8.14.1-1~bpo12+1","8.14.1-2","8.14.1-2+exp1","8.14.1-2~bpo12+1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.2.1-1","8.2.1-2","8.2.1-2~bpo12+1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1","8.3.0-1","8.3.0-2","8.3.0-2~bpo12+1","8.3.0-2~exp1","8.3.0-3","8.4.0-1","8.4.0-2","8.4.0-2~bpo12+1","8.5.0-1","8.5.0-1+exp1","8.5.0-2","8.5.0-2+exp1","8.5.0-2~bpo12+1","8.6.0-1","8.6.0-1.1","8.6.0-2","8.6.0-3","8.6.0-3.1","8.6.0-3.1~exp1","8.6.0-3.1~exp2","8.6.0-3.2","8.6.0-4","8.7.1-1","8.7.1-1+exp1","8.7.1-2","8.7.1-3","8.7.1-4","8.7.1-5","8.7.1-5+exp1","8.7.1-5~bpo12+1","8.8.0-1","8.8.0-1+exp1","8.8.0-1+exp2","8.8.0-1~bpo12+1","8.8.0-2","8.8.0-3","8.8.0-4","8.9.0-1","8.9.0-2","8.9.0-3","8.9.1-1","8.9.1-2","8.9.1-2~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u4"}]}],"versions":["8.14.1-2","8.14.1-2+deb13u1","8.14.1-2+deb13u2","8.14.1-2+deb13u2~bpo13+1","8.14.1-2+deb13u3"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20.0~rc3-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1"]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.20.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"7.71.1+0"},{"fixed":"8.20.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-49.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-29.oe2403"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-29.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-48.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-30.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20078"},{"fixed":"8.14.1-r20079"},{"fixed":"8.14.1-r200710"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20078"},{"fixed":"8.14.1-r20079"},{"fixed":"8.14.1-r200710"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r30075"},{"fixed":"8.14.1-r30076"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r30075"},{"fixed":"8.14.1-r30076"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"},{"fixed":"7.74.0-1.3+deb11u16.root.io.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"},{"fixed":"7.74.0-1.3+deb11u16.root.io.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.123.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150700.7.23.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.24"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15","7.81.0-1ubuntu1.16","7.81.0-1ubuntu1.17","7.81.0-1ubuntu1.18","7.81.0-1ubuntu1.19","7.81.0-1ubuntu1.20","7.81.0-1ubuntu1.21","7.81.0-1ubuntu1.22","7.81.0-1ubuntu1.23"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.9"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6","8.5.0-2ubuntu10.7","8.5.0-2ubuntu10.8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.3"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1","8.14.1-2ubuntu1.1","8.14.1-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.1"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1","8.18.0-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20.0-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-6276.json","tags":["Product","web"]},{"url":"https://curl.se/docs/CVE-2026-6276.html","tags":["Patch","Vendor Advisory","web","article","report"]},{"url":"https://hackerone.com/reports/3671818","tags":["exploit","Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/29/13","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2jc6-hc33-hv48","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-6276","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-6276","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779357790.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779358660.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1785773934.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1786119141.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1792808992.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6276.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6276","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2451","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2452","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2453","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2454","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2477","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:12916","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6253","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6429","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6276","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5773","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5545","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4873","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12916.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461200","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4873","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-4873.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5545","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-5545.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5773","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-5773.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461202","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6253","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-6253.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461203","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6276","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6429","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-6429.html","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261717-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259362","tags":["report"]},{"url":"https://bugzilla.suse.com/1262631","tags":["report"]},{"url":"https://bugzilla.suse.com/1262632","tags":["report"]},{"url":"https://bugzilla.suse.com/1262635","tags":["report"]},{"url":"https://bugzilla.suse.com/1262636","tags":["report"]},{"url":"https://bugzilla.suse.com/1262638","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6429","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261940-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621452-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622146-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622156-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262703-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262633","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5773","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263798-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263440","tags":["report"]},{"url":"https://bugzilla.suse.com/1268412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8926","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-6276","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8227-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-6276","title":"stale custom cookie host causes cookie leak","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","status":"published","published":"2026-05-13T08:28:19.273Z","modified":"2026-09-15T06:03:04.059Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T13:49:53.818886Z"}],"euvd":[{"id":"EUVD-2026-29928","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","status":"published","published":"2026-05-13T08:28:19Z","modified":"2026-09-15T06:03:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-2jc6-hc33-hv48","title":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request...","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","status":"published","published":"2026-05-13T18:30:52Z","modified":"2026-09-15T09:30:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-319","CWE-346"],"updated_at":"2026-11-02T15:11:53.5286Z"}],"nvd":[{"id":"CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","status":"published","published":"2026-05-13T13:01:56.8Z","modified":"2026-09-15T07:16:29.343Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-346","CWE-319"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"ALPINE-CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","status":"published","published":"2026-05-13T13:01:56.8Z","modified":"2026-10-18T12:30:04.074752146Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-6276","status":"published","published":"2026-05-01T06:09:38.824191Z","modified":"2026-05-15T07:19:47.84243Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"CVE-2026-6276","title":"stale custom cookie host causes cookie leak","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","status":"published","published":"2026-05-13T08:28:19.273Z","modified":"2026-10-28T11:18:22.307261053Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.","status":"published","published":"2026-05-13T13:01:56.8Z","modified":"2026-10-01T03:03:29.108334674Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"JLSEC-2026-1207","title":"Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request...","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","status":"published","published":"2026-08-07T20:11:58.984Z","modified":"2026-08-07T20:28:40.880265309Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2451","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:19:59.385572992Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2452","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:20:00.173223473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2453","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:20:00.167468481Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2454","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:20:00.207520282Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2477","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-29T11:11:26Z","modified":"2026-08-18T01:20:00.949425098Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:12916","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-03T10:03:35Z","modified":"2026-10-15T10:12:44Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2026-6276","title":"CVE-2026-6276 in curl - Patched by Root","description":"Root has patched CVE-2026-6276 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-11-04T10:54:49Z","modified":"2026-11-04T11:15:03.048795037Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T11:38:21.953745Z"},{"id":"ROOT-OS-ALPINE-317-CVE-2026-6276","title":"CVE-2026-6276 in curl - Patched by Root","description":"Root has patched CVE-2026-6276 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.","status":"published","published":"2026-11-04T16:15:55Z","modified":"2026-11-04T17:15:24.331152087Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-6276","title":"CVE-2026-6276 in curl - Patched by Root","description":"Root has patched CVE-2026-6276 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:40:45Z","modified":"2026-09-29T10:15:40.895004406Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-6276","title":"CVE-2026-6276 in curl - Patched by Root","description":"Root has patched CVE-2026-6276 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-10-07T06:27:29Z","modified":"2026-10-07T07:15:04.299728447Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2026-6276","title":"CVE-2026-6276 in curl - Patched by Root","description":"Root has patched CVE-2026-6276 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:36:08Z","modified":"2026-09-29T10:15:23.144997993Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-6276","title":"CVE-2026-6276 in curl - Patched by Root","description":"Root has patched CVE-2026-6276 in the curl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T12:49:54Z","modified":"2026-08-20T13:30:06.41966081Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-6276","title":"CVE-2026-6276 in curl - Patched by Root","description":"Root has patched CVE-2026-6276 in the curl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-04T06:00:50Z","modified":"2026-11-04T07:15:09.130192483Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T07:32:10.855619Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-6276","title":"CVE-2026-6276 in rootio-curl - Patched by Root","description":"Root has patched CVE-2026-6276 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-07-10T15:43:44Z","modified":"2026-07-13T14:00:22.553291193Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"UBUNTU-CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.","status":"published","published":"2026-04-29T14:00:00Z","modified":"2026-05-20T22:03:09.593720084Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"AZL-86655","title":"CVE-2026-6276 affecting package curl for versions less than 8.11.1-7","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","status":"published","published":"2026-05-13T13:01:56Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"AZL-86679","title":"CVE-2026-6276 affecting package cmake for versions less than 3.30.3-14","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","status":"published","published":"2026-05-13T13:01:56Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"CLSA-2026-1779357790","title":"curl: Fix of 2 CVEs","description":"- CVE-2026-5773: wrong reuse of SMB connection; disable connection reuse for\n  SMB(S) so a subsequent transfer cannot wrongfully reuse a pooled connection\n  to a different share\n- CVE-2026-6276: clear stale custom-Host cookiehost between requests on the\n  same easy handle (cookie leak across origins)","status":"published","published":"2026-05-21T14:36:58Z","modified":"2026-06-01T00:32:54.063124093Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779358660","title":"curl: Fix of 2 CVEs","description":"- CVE-2026-5773: wrong reuse of SMB connection; disable connection reuse for\n  SMB(S) so a subsequent transfer cannot wrongfully reuse a pooled connection\n  to a different share\n- CVE-2026-6276: clear stale custom-Host cookiehost between requests on the\n  same easy handle (cookie leak across origins)","status":"published","published":"2026-05-21T14:43:49Z","modified":"2026-06-01T00:32:34.257817755Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1785773934","title":"curl: Fix of CVE-2026-6276","description":"- CVE-2026-6276: http: clear the custom Host: name remembered for cookies at the start of each request","status":"published","published":"2026-08-06T14:49:17Z","modified":"2026-10-26T09:31:43.007607217Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786119141","title":"Fix of 5 CVEs","description":"   * SECURITY UPDATE: stale custom cookie host causes cookie leak\n     - debian/patches/CVE-2026-6276.patch: clear the remembered custom\n       Host: name at the start of every request in lib/http.c.\n     - CVE-2026-6276\n   * SECURITY UPDATE: wrong STARTTLS connection reuse\n     - debian/patches/CVE-2026-8286.patch: require a matching SSL\n       configuration when reusing a connection for a transfer that may\n       upgrade to TLS in lib/url.c.\n     - CVE-2026-8286\n   * SECURITY UPDATE: env-set cross-proxy Digest auth state leak\n     - debian/patches/CVE-2026-8927.patch: flush the proxy Digest state\n       when the proxy read from the environment changes in lib/url.c,\n       lib/urldata.h.\n     - CVE-2026-8927\n   * SECURITY UPDATE: incomplete mTLS config in connection reuse and TLS\n     session cache\n     - debian/patches/CVE-2026-8932.patch: include the client private key\n       options in the primary SSL config so connection reuse and the TLS\n       session cache compare them in lib/url.c, lib/urldata.h,\n       lib/vtls/vtls.c.\n     - CVE-2026-8932\n   * SECURITY UPDATE: HTTP/2 push headers memory leak\n     - debian/patches/CVE-2024-2398.patch: free the whole set of push\n       headers on the array-growth failure path in lib/http2.c.\n     - CVE-2024-2398","status":"published","published":"2026-08-13T02:39:13Z","modified":"2026-10-26T09:43:32.943516823Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1792808992","title":"curl: Fix of CVE-2026-6276","description":"- CVE-2026-6276: clear the custom Host cookie host per request so cookies\n  are not sent to another origin on connection reuse","status":"published","published":"2026-10-24T02:30:03Z","modified":"2026-10-26T09:31:53.779537242Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CURL-CVE-2026-6276","title":"stale custom cookie host causes cookie leak","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.","status":"published","published":"2026-04-29T08:00:00Z","modified":"2026-10-25T01:16:47.193144136Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2026:10674-1","title":"curl-8.20.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.20.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-04T00:00:00Z","modified":"2026-05-05T07:46:40.778646Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20973-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n","status":"published","published":"2026-06-17T08:47:34Z","modified":"2026-06-24T18:24:21.071415239Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:1717-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n\nOther updates and bugfixes:\n\n- sws: prevent 'connection monitor' to say disconnect twice (bsc#1259362).\n","status":"published","published":"2026-05-06T12:13:54Z","modified":"2026-05-07T08:46:21.899858Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1940-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n\nOther updates and bugfixes:\n\n- sws: prevent 'connection monitor' to say disconnect twice (bsc#1259362).\n","status":"published","published":"2026-05-18T07:44:20Z","modified":"2026-05-19T08:45:08.261772469Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21452-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n\nOther updates and bugfixes:\n\n- sws: prevent \"connection monitor\" to say disconnect twice (bsc#1259362).\n","status":"published","published":"2026-04-30T14:46:10Z","modified":"2026-05-05T18:23:55.855178Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22146-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n","status":"published","published":"2026-06-17T08:57:16Z","modified":"2026-06-19T18:24:06.180348168Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22156-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n","status":"published","published":"2026-06-17T08:57:16Z","modified":"2026-06-24T18:24:22.566714968Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2703-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n","status":"published","published":"2026-06-30T10:27:48Z","modified":"2026-07-01T09:45:07.290337429Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:3798-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n","status":"published","published":"2026-08-25T12:41:04Z","modified":"2026-08-27T11:01:49.76472582Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}