{"id":"CVE-2026-87866","aliases":["ALPINE-CVE-2026-87866","AZL-109920","AZL-109953","AZL-110028","AZL-110133","AZL-110211","AZL-110286","BELL-CVE-2026-87866","CURL-CVE-2026-87866","DEBIAN-CVE-2026-87866","EUVD-2026-105314","GHSA-wq9f-qmpx-2cc8","OESA-2026-4849","OESA-2026-4850","OESA-2026-4851","OESA-2026-4852","RHSA-2026:82895","ROOT-OS-ALPINE-315-CVE-2026-87866","ROOT-OS-ALPINE-321-CVE-2026-87866","openSUSE-SU-2026:12150-1"],"status":"published","title":"wolfSSL public-key pinning bypass","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0051,"percentile":0.43991,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-10-14T08:00:00Z","modified":"2026-11-11T12:45:12Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.23.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.23.0-r0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"curl","fixed_in":["8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-curl","fixed_in":["8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"curl","fixed_in":["8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-curl","fixed_in":["8.14.1-r300712"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.23.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.23.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.30.3-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.11.1-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.0.46-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.75.0-31"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"last_affected":"1.96.1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.1-11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u11","7.88.1-10+deb12u12","7.88.1-10+deb12u13","7.88.1-10+deb12u14","7.88.1-10+deb12u15","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6","7.88.1-10+deb12u6~bpo11+1","7.88.1-10+deb12u7","7.88.1-10+deb12u8","7.88.1-10+deb12u9","7.88.1-11","8.0.1-1~exp1","8.10.0-1","8.10.0-2","8.10.1-1","8.10.1-1~bpo12+1","8.10.1-2","8.11.0-1","8.11.1-1","8.11.1-1~bpo12+1","8.12.0+git20250209.89ed161+ds-1","8.12.0+git20250209.89ed161+ds-1~bpo12+1","8.12.1-1","8.12.1-2","8.12.1-2~bpo12+1","8.12.1-3","8.12.1-3~bpo12+1","8.13.0-1","8.13.0-1+exp1","8.13.0-2","8.13.0-2+exp1","8.13.0-3","8.13.0-4","8.13.0-4+exp1","8.13.0-5","8.13.0-5+exp1","8.13.0-5~bpo12+1","8.13.0~rc-1~exp1","8.13.0~rc-1~exp2","8.13.0~rc2-1","8.13.0~rc2-2","8.13.0~rc3-1","8.13.0~rc3-1+exp1","8.14.0-1","8.14.0-1+exp1","8.14.0~rc1-1+exp1","8.14.0~rc2-1+exp1","8.14.0~rc3-1+exp1","8.14.1-1","8.14.1-1~bpo12+1","8.14.1-2","8.14.1-2+exp1","8.14.1-2~bpo12+1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.2.1-1","8.2.1-2","8.2.1-2~bpo12+1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0-1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1","8.23.0~rc3-1","8.23.0~rc3-1+exp1","8.3.0-1","8.3.0-2","8.3.0-2~bpo12+1","8.3.0-2~exp1","8.3.0-3","8.4.0-1","8.4.0-2","8.4.0-2~bpo12+1","8.5.0-1","8.5.0-1+exp1","8.5.0-2","8.5.0-2+exp1","8.5.0-2~bpo12+1","8.6.0-1","8.6.0-1.1","8.6.0-2","8.6.0-3","8.6.0-3.1","8.6.0-3.1~exp1","8.6.0-3.1~exp2","8.6.0-3.2","8.6.0-4","8.7.1-1","8.7.1-1+exp1","8.7.1-2","8.7.1-3","8.7.1-4","8.7.1-5","8.7.1-5+exp1","8.7.1-5~bpo12+1","8.8.0-1","8.8.0-1+exp1","8.8.0-1+exp2","8.8.0-1~bpo12+1","8.8.0-2","8.8.0-3","8.8.0-4","8.9.0-1","8.9.0-2","8.9.0-3","8.9.1-1","8.9.1-2","8.9.1-2~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.1-2","8.14.1-2+deb13u1","8.14.1-2+deb13u2","8.14.1-2+deb13u2~bpo13+1","8.14.1-2+deb13u3","8.14.1-2+deb13u4","8.14.1-2+deb13u5","8.14.1-2+deb13u7","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0-1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1","8.23.0~rc3-1","8.23.0~rc3-1+exp1"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0-1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1","8.23.0~rc3-1","8.23.0~rc3-1+exp1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-38.oe2403sp4"}]}],"bundled":15},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-57.oe2203sp4"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-38.oe2403sp1"}]}],"bundled":15},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-38.oe2403sp3"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.23.0-0.1.hum1"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.23.0-0.1.hum1"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.23.0-0.1.hum1"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.23.0-0.1.hum1"}]}],"bundled":26},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.23.0-1.1"}]}],"bundled":23}],"products":[{"vendor":"curl","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-87866.json"},{"url":"https://curl.se/docs/CVE-2026-87866.html"},{"url":"https://hackerone.com/reports/3989514","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wq9f-qmpx-2cc8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-87866","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-87866","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-87866","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4849","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4850","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4851","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82895","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92392","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92388","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86414","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14017","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9086","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14819","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86410","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92389","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94265","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107928","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87866","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94266","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107929","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92386","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92391","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92390","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86413","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92387","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87865","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87863","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87864","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87862","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87861","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86409","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86411","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86412","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82895.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2394750","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9086","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-9086.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-9086.json","tags":["article"]},{"url":"https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6","tags":["article"]},{"url":"https://hackerone.com/reports/3294999","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427870","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14017","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14017.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-14017.json","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426408","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14819","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14819.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550378","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86409","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86410","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86411","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550374","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550594","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86413","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86414","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550611","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87862","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550645","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87863","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550666","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87864","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550675","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87865","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87866","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550682","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92386","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550691","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92388","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550700","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92389","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550702","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92390","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550708","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92391","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548642","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94266","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550720","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107928","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550721","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-87866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94266","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-87866","title":"wolfSSL public-key pinning bypass","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T20:16:30.866Z","modified":"2026-10-29T18:59:00.981Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T13:37:47.463822Z"}],"euvd":[{"id":"EUVD-2026-105314","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T20:16:30Z","modified":"2026-10-29T18:59:00Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:59:15.044173Z"}],"ghsa":[{"id":"GHSA-wq9f-qmpx-2cc8","title":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key...","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T21:31:08Z","modified":"2026-10-29T21:31:14Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:14:40.528345Z"}],"nvd":[{"id":"CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T21:17:20.833Z","modified":"2026-10-29T19:17:27.917Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:13:01.161484Z"}],"osv":[{"id":"ALPINE-CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T21:17:20.833Z","modified":"2026-10-30T09:30:04.206331758Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-87866","title":"CVE-2026-87866 does not affect BellSoft software","status":"withdrawn","published":"2026-10-17T06:05:40.65865Z","modified":"2026-10-31T07:15:03.537443493Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:28:26.630331Z"},{"id":"DEBIAN-CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.","status":"published","published":"2026-10-20T21:17:20.833Z","modified":"2026-10-30T10:00:32.130095593Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"OESA-2026-4849","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nWhen curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send.(CVE-2026-107928)\n\nSetting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information.(CVE-2026-86409)\n\nA flaw in the curl command line tool\u0026apos;s logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect.(CVE-2026-86410)\n\nAn HTTP proxy can trick libcurl into sending the origin\u0026apos;s credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`.(CVE-2026-86414)\n\nImporting a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild\u0026apos;s valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS.(CVE-2026-87862)\n\nAn authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss.(CVE-2026-87863)\n\nEnabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session.(CVE-2026-87864)\n\nWhen libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.(CVE-2026-87865)\n\nWhen built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl\u0026apos;s subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.(CVE-2026-87866)\n\nWhen writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile.(CVE-2026-92386)\n\nWhen an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer.(CVE-2026-92388)\n\nlibcurl\u0026apos;s TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle\u0026apos;s persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle.(CVE-2026-92389)\n\nWhen invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint.(CVE-2026-92390)\n\nA deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process.(CVE-2026-92391)\n\nlibcurl could accidentally return a URL for `curl_easy_getinfo()`\u0026apos;s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did.(CVE-2026-94266)","status":"published","published":"2026-11-11T12:26:48Z","modified":"2026-11-11T12:45:09.653939298Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4850","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSetting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information.(CVE-2026-86409)\n\nAn HTTP proxy can trick libcurl into sending the origin\u0026apos;s credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`.(CVE-2026-86414)\n\nImporting a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild\u0026apos;s valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS.(CVE-2026-87862)\n\nAn authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss.(CVE-2026-87863)\n\nEnabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session.(CVE-2026-87864)\n\nWhen libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.(CVE-2026-87865)\n\nWhen built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl\u0026apos;s subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.(CVE-2026-87866)\n\nWhen an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer.(CVE-2026-92388)\n\nlibcurl\u0026apos;s TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle\u0026apos;s persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle.(CVE-2026-92389)\n\nWhen invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint.(CVE-2026-92390)\n\nA deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process.(CVE-2026-92391)\n\nlibcurl could accidentally return a URL for `curl_easy_getinfo()`\u0026apos;s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did.(CVE-2026-94266)","status":"published","published":"2026-11-11T12:26:49Z","modified":"2026-11-11T12:45:12.274777301Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4851","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nWhen curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send.(CVE-2026-107928)\n\nSetting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information.(CVE-2026-86409)\n\nA flaw in the curl command line tool\u0026apos;s logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect.(CVE-2026-86410)\n\nAn HTTP proxy can trick libcurl into sending the origin\u0026apos;s credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`.(CVE-2026-86414)\n\nImporting a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild\u0026apos;s valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS.(CVE-2026-87862)\n\nAn authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss.(CVE-2026-87863)\n\nEnabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session.(CVE-2026-87864)\n\nWhen libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.(CVE-2026-87865)\n\nWhen built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl\u0026apos;s subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.(CVE-2026-87866)\n\nWhen writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile.(CVE-2026-92386)\n\nWhen an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer.(CVE-2026-92388)\n\nlibcurl\u0026apos;s TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle\u0026apos;s persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle.(CVE-2026-92389)\n\nWhen invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint.(CVE-2026-92390)\n\nA deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process.(CVE-2026-92391)\n\nlibcurl could accidentally return a URL for `curl_easy_getinfo()`\u0026apos;s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did.(CVE-2026-94266)","status":"published","published":"2026-11-11T12:26:50Z","modified":"2026-11-11T12:45:12.569121574Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4852","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nWhen curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send.(CVE-2026-107928)\n\nSetting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information.(CVE-2026-86409)\n\nA flaw in the curl command line tool\u0026apos;s logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect.(CVE-2026-86410)\n\nAn HTTP proxy can trick libcurl into sending the origin\u0026apos;s credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`.(CVE-2026-86414)\n\nImporting a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild\u0026apos;s valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS.(CVE-2026-87862)\n\nAn authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss.(CVE-2026-87863)\n\nEnabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session.(CVE-2026-87864)\n\nWhen libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.(CVE-2026-87865)\n\nWhen built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl\u0026apos;s subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.(CVE-2026-87866)\n\nWhen writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile.(CVE-2026-92386)\n\nWhen an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer.(CVE-2026-92388)\n\nlibcurl\u0026apos;s TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle\u0026apos;s persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle.(CVE-2026-92389)\n\nWhen invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint.(CVE-2026-92390)\n\nA deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process.(CVE-2026-92391)\n\nlibcurl could accidentally return a URL for `curl_easy_getinfo()`\u0026apos;s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did.(CVE-2026-94266)","status":"published","published":"2026-11-11T12:26:51Z","modified":"2026-11-11T12:45:11.721391538Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"RHSA-2026:82895","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-15T10:28:47Z","modified":"2026-10-18T10:05:11Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"AZL-109920","title":"CVE-2026-87866 affecting package cmake 3.30.3-15","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T21:17:20Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"AZL-109953","title":"CVE-2026-87866 affecting package curl 8.11.1-11","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T21:17:20Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"AZL-110028","title":"CVE-2026-87866 affecting package mysql 8.0.46-2","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T21:17:20Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"AZL-110133","title":"CVE-2026-87866 affecting package rust 1.75.0-31","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T21:17:20Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"AZL-110211","title":"CVE-2026-87866 affecting package rust 1.96.1-2","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T21:17:20Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"AZL-110286","title":"CVE-2026-87866 affecting package tensorflow 2.16.1-11","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-20T21:17:20Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"CURL-CVE-2026-87866","title":"wolfSSL public-key pinning bypass","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.","status":"published","published":"2026-10-14T08:00:00Z","modified":"2026-10-27T01:28:37.041864055Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2026:12150-1","title":"curl-8.23.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.23.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-16T00:00:00Z","modified":"2026-10-17T10:00:05.085098051Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2026-87866","title":"CVE-2026-87866 in curl - Patched by Root","description":"Root has patched CVE-2026-87866 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-11-04T10:54:49Z","modified":"2026-11-04T11:15:02.988678149Z","updated_at":"2026-11-04T11:38:21.953745Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-87866","title":"CVE-2026-87866 in curl - Patched by Root","description":"Root has patched CVE-2026-87866 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-11-03T11:37:01Z","modified":"2026-11-03T12:15:05.003279438Z","updated_at":"2026-11-03T12:31:35.467775Z"}]}}