{"id":"CVE-2026-8926","aliases":["ALPINE-CVE-2026-8926","ALSA-2026:69125","AZL-91821","BELL-CVE-2026-8926","CLSA-2026-1786091577","CLSA-2026-1786094315","CURL-CVE-2026-8926","DEBIAN-CVE-2026-8926","EUVD-2026-41507","GHSA-vw2x-3w8j-rq82","JLSEC-2026-1215","OESA-2026-3170","OESA-2026-3171","OESA-2026-3172","RHSA-2026:29017","RHSA-2026:34975","RHSA-2026:69125","RHSA-2026:72506","RLSA-2026:69125","ROOT-OS-ALPINE-320-CVE-2026-8926","ROOT-OS-ALPINE-321-CVE-2026-8926","ROOT-OS-ALPINE-322-CVE-2026-8926","ROOT-OS-ALPINE-323-CVE-2026-8926","ROOT-OS-DEBIAN-13-CVE-2026-8926","SUSE-SU-2026:23350-1","SUSE-SU-2026:23361-1","SUSE-SU-2026:23498-1","SUSE-SU-2026:23638-1","SUSE-SU-2026:3798-1","SUSE-SU-2026:3958-1","SUSE-SU-2026:4047-1","UBUNTU-CVE-2026-8926","openSUSE-SU-2026:11230-1","openSUSE-SU-2026:21774-1"],"status":"published","title":"password leak with netrc and user in URL","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00444,"percentile":0.38834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-522"],"published":"2026-06-24T08:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.11.1-10"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.21.0~rc2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.21.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.21.0+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"curl","fixed_in":["8.4.0-33.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","fixed_in":["8.4.0-33.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"curl","fixed_in":["8.4.0-33.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"curl","fixed_in":["8.14.1-r20073","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r20078","8.14.1-r20079","8.14.1-r200710","8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-curl","fixed_in":["8.14.1-r20073","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r20078","8.14.1-r20079","8.14.1-r200710","8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"curl","fixed_in":["8.14.1-r20072","8.14.1-r20073","8.14.1-r30078","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-curl","fixed_in":["8.14.1-r20072","8.14.1-r20073","8.14.1-r30078","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"curl","fixed_in":["8.14.1-r20072","8.14.1-r20071","8.14.1-r20073","8.14.1-r20074","8.14.1-r400710","8.14.1-r30075","8.14.1-r30076","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"rootio-curl","fixed_in":["8.14.1-r20072","8.14.1-r20071","8.14.1-r20073","8.14.1-r20074","8.14.1-r400710","8.14.1-r30075","8.14.1-r30076","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u7.aikido.24","8.14.1-2+deb13u7.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-curl","fixed_in":["8.14.1-2+deb13u7.aikido.24","8.14.1-2+deb13u7.aikido.25"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"curl","fixed_in":["8.14.1-2ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"curl","fixed_in":["8.18.0-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.1"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.1"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.1-10"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els18"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.1-2","8.14.1-2+deb13u1","8.14.1-2+deb13u2","8.14.1-2+deb13u2~bpo13+1","8.14.1-2+deb13u3","8.14.1-2+deb13u4","8.14.1-2+deb13u5","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.21.0~rc2-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0~rc1-1+exp1"]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.11.1+0"},{"fixed":"8.21.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.11.1+0"},{"fixed":"8.21.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-33.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-33.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-33.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-none-softfloat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-i686-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-wasip1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-none","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.10"}]}],"bundled":14},{"source":"osv","ecosystem":"Rocky Linux:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r20078"},{"fixed":"8.14.1-r20079"},{"fixed":"8.14.1-r200710"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r20078"},{"fixed":"8.14.1-r20079"},{"fixed":"8.14.1-r200710"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30075"},{"fixed":"8.14.1-r30076"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30075"},{"fixed":"8.14.1-r30076"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u7.aikido.24"},{"fixed":"8.14.1-2+deb13u7.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u7.aikido.24"},{"fixed":"8.14.1-2+deb13u7.aikido.25"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150700.7.23.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.91.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.91.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.91.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.51.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.51.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.4"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1","8.14.1-2ubuntu1.1","8.14.1-2ubuntu1.2","8.14.1-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.2"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1","8.18.0-1ubuntu2","8.18.0-1ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.21.0-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-8926.json","tags":["Vendor Advisory","web","article"]},{"url":"https://curl.se/docs/CVE-2026-8926.html","tags":["Patch","Vendor Advisory","web","article"]},{"url":"https://hackerone.com/reports/3735184","tags":["exploit","Exploit","Issue Tracking","Third Party Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vw2x-3w8j-rq82","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-8926","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69125","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11856","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8458","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8924","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8926","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8932","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9079","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496759","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496760","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496764","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496765","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496767","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496771","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-69125.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-8926","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1786091577.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1786094315.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8926.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-8926","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3170","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3171","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3172","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29017","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12064","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8286","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11352","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11586","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9546","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8927","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8925","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11564","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9080","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9547","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29017.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8286.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8286.json","tags":["article"]},{"url":"https://hackerone.com/reports/3718195","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496764","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8458","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8458.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8458.json","tags":["article"]},{"url":"https://hackerone.com/reports/3721183","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496765","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8924.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8924.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733905","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8925.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8925.json","tags":["article"]},{"url":"https://hackerone.com/reports/3735193","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496760","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8926","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496769","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8927.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8927.json","tags":["article"]},{"url":"https://hackerone.com/reports/3744543","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8932.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8932.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733910","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496771","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9079.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9079.json","tags":["article"]},{"url":"https://hackerone.com/reports/3750295","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9080.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9080.json","tags":["article"]},{"url":"https://hackerone.com/reports/3749204","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496770","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9546.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9546.json","tags":["article"]},{"url":"https://hackerone.com/reports/3754343","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496758","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9547.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9547.json","tags":["article"]},{"url":"https://hackerone.com/reports/3751712","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496757","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11352","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11352.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11352.json","tags":["article"]},{"url":"https://hackerone.com/reports/3783438","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11564","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11564.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11564.json","tags":["article"]},{"url":"https://hackerone.com/reports/3788984","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496753","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11586","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11586.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11586.json","tags":["article"]},{"url":"https://hackerone.com/reports/3788931","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11856.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11856.json","tags":["article"]},{"url":"https://hackerone.com/reports/3793260","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-12064.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-12064.json","tags":["article"]},{"url":"https://hackerone.com/reports/3797526","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34975","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-38969","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14683","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14685","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14686","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14684","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59870","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59868","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15187","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34975.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497102","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14683","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/","tags":["article"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/219","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14683","tags":["article"]},{"url":"https://vuldb.com/submit/846750","tags":["article"]},{"url":"https://vuldb.com/submit/846752","tags":["article"]},{"url":"https://vuldb.com/vuln/376279","tags":["article"]},{"url":"https://vuldb.com/vuln/376279/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14684","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/220","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14684","tags":["article"]},{"url":"https://vuldb.com/submit/846754","tags":["article"]},{"url":"https://vuldb.com/vuln/376280","tags":["article"]},{"url":"https://vuldb.com/vuln/376280/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497101","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14685","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/221","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14685","tags":["article"]},{"url":"https://vuldb.com/submit/846761","tags":["article"]},{"url":"https://vuldb.com/vuln/376281","tags":["article"]},{"url":"https://vuldb.com/vuln/376281/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14686","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/222","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14686","tags":["article"]},{"url":"https://vuldb.com/submit/846762","tags":["article"]},{"url":"https://vuldb.com/vuln/376282","tags":["article"]},{"url":"https://vuldb.com/vuln/376282/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15187","tags":["advisory"]},{"url":"https://github.com/enquirer/enquirer/","tags":["article"]},{"url":"https://github.com/enquirer/enquirer/issues/487","tags":["article"]},{"url":"https://github.com/enquirer/enquirer/issues/487#issuecomment-4648521328","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-15187","tags":["article"]},{"url":"https://vuldb.com/submit/851357","tags":["article"]},{"url":"https://vuldb.com/vuln/377113","tags":["article"]},{"url":"https://vuldb.com/vuln/377113/cti","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-38969","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59868","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59870","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69125.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72506","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446450","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72506.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14819","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14819","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14819.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1965","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1965","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-1965.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-1965.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/2","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3783.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3783.json","tags":["article"]},{"url":"https://hackerone.com/reports/3583983","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3784","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/3","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.json","tags":["article"]},{"url":"https://hackerone.com/reports/3584903","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69125","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623350-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262633","tags":["report"]},{"url":"https://bugzilla.suse.com/1263440","tags":["report"]},{"url":"https://bugzilla.suse.com/1264971","tags":["report"]},{"url":"https://bugzilla.suse.com/1268412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8926","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623361-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623498-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1277476","tags":["report"]},{"url":"https://bugzilla.suse.com/1277479","tags":["report"]},{"url":"https://bugzilla.suse.com/1277480","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80230","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623638-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263798-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262632","tags":["report"]},{"url":"https://bugzilla.suse.com/1262635","tags":["report"]},{"url":"https://bugzilla.suse.com/1262636","tags":["report"]},{"url":"https://bugzilla.suse.com/1262638","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6429","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263958-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264047-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-8926","tags":["report"]},{"url":"https://curl.se/L7HzKXisfJ/CVE-2026-8926.md","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8487-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9547","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-8926","title":"password leak with netrc and user in URL","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.","status":"published","published":"2026-07-03T06:15:45.735Z","modified":"2026-09-15T06:03:23.777Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-41507","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.","status":"published","published":"2026-07-03T06:15:45Z","modified":"2026-09-15T06:03:23Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-vw2x-3w8j-rq82","title":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL...","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username(without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.","status":"published","published":"2026-07-03T09:31:27Z","modified":"2026-07-08T00:38:56Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:09:18.783285Z"}],"nvd":[{"id":"CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.","status":"published","published":"2026-07-03T07:16:25.037Z","modified":"2026-09-15T07:16:32.98Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:12:27.541515Z"}],"osv":[{"id":"ALPINE-CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.","status":"published","published":"2026-07-03T07:16:25.037Z","modified":"2026-10-01T02:17:49.419008407Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BELL-CVE-2026-8926","status":"published","published":"2026-07-02T17:40:10.581494Z","modified":"2026-07-08T07:15:16.086930889Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:28:26.630331Z"},{"id":"CVE-2026-8926","title":"password leak with netrc and user in URL","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.","status":"published","published":"2026-07-03T06:15:45.735Z","modified":"2026-10-28T11:01:39.795077029Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.","status":"published","published":"2026-07-03T07:16:25.037Z","modified":"2026-10-01T03:03:52.213159329Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"JLSEC-2026-1215","title":"When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL...","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username(without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.","status":"published","published":"2026-08-07T20:11:58.984Z","modified":"2026-08-07T20:28:39.457270678Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-3170","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nWhen asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username(without a password), like\n`https://(CVE-2026-8926)","status":"published","published":"2026-07-24T11:12:02Z","modified":"2026-08-18T01:21:24.297900531Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3171","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nWhen asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username(without a password), like\n`https://(CVE-2026-8926)","status":"published","published":"2026-07-24T11:12:02Z","modified":"2026-08-18T01:21:23.948447468Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3172","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nWhen asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username(without a password), like\n`https://(CVE-2026-8926)","status":"published","published":"2026-07-24T11:12:03Z","modified":"2026-08-18T01:21:24.136291631Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:29017","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-16T10:07:43Z","modified":"2026-10-17T10:11:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:34975","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-04T10:07:59Z","modified":"2026-10-17T10:12:31Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:69125","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-09-22T10:19:47Z","modified":"2026-10-16T10:23:50Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:72506","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-09-29T10:18:29Z","modified":"2026-10-16T10:24:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:69125","title":"Important: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)\n\n* curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)\n\n* curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)\n\n* curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)\n\n* curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)\n\n* libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-22T12:08:07.529031Z","modified":"2026-09-22T12:30:02.634508572Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.","status":"published","published":"2026-06-24T14:00:00Z","modified":"2026-09-24T02:00:54.425812523Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:69125","title":"Important: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  \n\nSecurity Fix(es):  \n\n  * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)\n  * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)\n  * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)\n  * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)\n  * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)\n  * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-10-29T11:30:41.694588463Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-91821","title":"CVE-2026-8926 affecting package curl for versions less than 8.11.1-10","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.","status":"published","published":"2026-07-03T07:16:25Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1786091577","title":"curl: Fix of 2 CVEs","description":"- CVE-2026-8458: tie the requested SASL/SPNEGO service name to the connection\n  and compare it when matching an existing connection for reuse, so a\n  Negotiate authenticated connection is not reused for a transfer that asked\n  for a different service\n- CVE-2026-8926: discard a .netrc entry that matches the host but whose login\n  does not match the user given in the URL, so the password that belongs to\n  another user of that host is no longer returned as a successful lookup","status":"published","published":"2026-08-07T08:33:07Z","modified":"2026-10-26T09:31:26.295461332Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786094315","title":"curl: Fix of 2 CVEs","description":"- CVE-2026-8458: tie the requested SASL/SPNEGO service name to the connection\n  and compare it when matching an existing connection for reuse, so a\n  Negotiate authenticated connection is not reused for a transfer that asked\n  for a different service\n- CVE-2026-8926: discard a .netrc entry that matches the host but whose login\n  does not match the user given in the URL, so the password that belongs to\n  another user of that host is no longer returned as a successful lookup","status":"published","published":"2026-08-07T09:18:46Z","modified":"2026-10-26T09:30:31.728017122Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CURL-CVE-2026-8926","title":"password leak with netrc and user in URL","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.","status":"published","published":"2026-06-24T08:00:00Z","modified":"2026-10-25T01:05:48.961296766Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2026:11230-1","title":"curl-8.21.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.392224841Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21774-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).\n- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).\n","status":"published","published":"2026-09-06T16:56:18Z","modified":"2026-09-09T18:23:14.977934943Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-8926","title":"CVE-2026-8926 in curl - Patched by Root","description":"Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:40:45Z","modified":"2026-09-29T10:15:40.548689946Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-8926","title":"CVE-2026-8926 in curl - Patched by Root","description":"Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-11-03T11:37:01Z","modified":"2026-11-03T12:15:05.964842263Z","updated_at":"2026-11-03T12:31:35.467775Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2026-8926","title":"CVE-2026-8926 in curl - Patched by Root","description":"Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.","status":"published","published":"2026-10-19T06:56:08Z","modified":"2026-10-19T07:15:05.981109142Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-323-CVE-2026-8926","title":"CVE-2026-8926 in curl - Patched by Root","description":"Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-11T14:25:22Z","modified":"2026-10-09T13:00:09.883744493Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-8926","title":"CVE-2026-8926 in curl - Patched by Root","description":"Root has patched CVE-2026-8926 in the curl package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-11-03T10:50:30Z","modified":"2026-11-03T11:15:05.87199278Z","updated_at":"2026-11-03T11:30:16.221977Z"},{"id":"SUSE-SU-2026:23350-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n\nChanges for curl:\n\n- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero\n Content-Length empty body check (bsc#1264971)\n","status":"published","published":"2026-08-26T15:33:27Z","modified":"2026-09-10T18:23:12.496266156Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23361-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n\nChanges for curl:\n\n- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero\n Content-Length empty body check (bsc#1264971)\n","status":"published","published":"2026-08-26T15:41:27Z","modified":"2026-09-10T18:23:12.594530711Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23498-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).\n- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).\n","status":"published","published":"2026-09-06T16:57:12Z","modified":"2026-09-14T18:23:13.86762477Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23638-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).\n- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).\n","status":"published","published":"2026-09-06T16:57:12Z","modified":"2026-09-29T18:23:10.493555771Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3798-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n","status":"published","published":"2026-08-25T12:41:04Z","modified":"2026-08-27T11:01:49.76472582Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3958-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).\n- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).\n\nChanges for curl:\n\n- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero\n Content-Length empty body check (bsc#1264971)\n","status":"published","published":"2026-09-03T13:32:12Z","modified":"2026-09-13T18:23:12.410814638Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4047-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).\n- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).\n\nChanges for curl:\n\n- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero\n Content-Length empty body check (bsc#1264971)\n","status":"published","published":"2026-09-07T13:53:51Z","modified":"2026-09-13T18:23:18.224672627Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}