Curl vulnerabilities

Products

• Curl 126
• Libcurl 6

Newest

• curl Authorization: Negotiate sent to foreign origin CVE-2026-94265 Fix available 9.1 CriticalOctober 14, 2026
• curl wolfSSL public-key pinning bypass CVE-2026-87866 Fix available 9.1 CriticalOctober 14, 2026
• curl cross-origin reuse of a Negotiate connection CVE-2026-87861 Fix available 9.1 CriticalOctober 14, 2026
• curl auto client cert connection reuse mixup CVE-2026-86415 Fix available 7.5 HighOctober 14, 2026
• curl Negotiate credentials sent to redirected origin CVE-2026-86413 Fix available 9.1 CriticalOctober 14, 2026
• curl FTP connection reuse inherits client-certificate CVE-2026-86411 Fix available 9.1 CriticalOctober 14, 2026
• curl password leak in CURLINFO_EFFECTIVE_URL CVE-2026-94266 Fix available 7.5 HighOctober 14, 2026
• curl HTTP/2 upload Use-After-Free CVE-2026-92392 Public exploitFix available 8.1 HighOctober 14, 2026
• curl curl_mime_free stack overflow by recursion CVE-2026-92391 Fix available 7.5 HighOctober 14, 2026
• curl -J no-clobber guarantee bypassed with 103 early hints CVE-2026-92390 Fix available 7.5 HighOctober 14, 2026
• curl TFTP direction confusion CVE-2026-92389 Fix available 8.1 HighOctober 14, 2026
• curl FTP wildcard write callback mixup CVE-2026-92388 Fix available 9.1 CriticalOctober 14, 2026
• curl never-ending loop via server response omission CVE-2026-92387 Fix available 8.1 HighOctober 14, 2026
• curl server-set cookie aborts cookie jar load CVE-2026-92386 Fix available 8.1 HighOctober 14, 2026
• curl knownhost callback mismatches key as missing CVE-2026-87865 Fix available 7.4 HighOctober 14, 2026
• curl IMAP APPEND plus CRLF conversion command injection CVE-2026-87864 Fix available 8.1 HighOctober 14, 2026
• curl HSTS response erases persisted entries CVE-2026-87863 Fix available 8.1 HighOctober 14, 2026
• curl HSTS cache import drops longer-lived child CVE-2026-87862 Fix available 8.1 HighOctober 14, 2026
• curl leaking host credentials to HTTP proxy CVE-2026-86414 Fix available 9.1 CriticalOctober 14, 2026
• curl server-set cookie erases cookie jar CVE-2026-86412 Fix available 8.1 HighOctober 14, 2026
• curl redirect to SFTP or SCP bypasses host verification CVE-2026-86410 Fix available 8.1 HighOctober 14, 2026
• curl stale SigV4 headers sent unintended CVE-2026-86409 Fix available 8.1 HighOctober 14, 2026
• curl local interface connection reuse mixup CVE-2026-107929 Fix available 8.1 HighOctober 14, 2026
• curl info leak uploading over WebSockets with GnuTLS CVE-2026-107928 Fix available 8.1 HighOctober 14, 2026
• curl domain-scoped PSL domain cookie CVE-2026-82209 Fix available 8.2 HighSeptember 2, 2026
• curl secure cookie attribute bypass with tab CVE-2026-80255 Fix available 7.5 HighSeptember 2, 2026
• curl OpenSSL pinning bypass CVE-2026-80230 Fix available 7.5 HighSeptember 2, 2026
• curl OpenSSL provider use-after-free CVE-2026-80229 Fix available 7.5 HighSeptember 2, 2026
• curl Negotiate ambient user conn reuse CVE-2026-19931 Fix available 9.8 CriticalSeptember 2, 2026
• curl HTTP/2 server push UAF CVE-2026-18924 Fix available 9.1 CriticalSeptember 2, 2026
• curl OpenLDAP SASL authentication bypass CVE-2026-13608 Fix available 7.4 HighSeptember 2, 2026
• curl wolfSSL CA-cache hit overrides callback CVE-2026-82208 Fix available 7.5 HighSeptember 2, 2026
• curl native CA store conn reuse CVE-2026-80231 Fix available 7.5 HighSeptember 2, 2026
• curl SSH improper host validation CVE-2026-9547 Fix available 7.4 HighJune 24, 2026
• curl sending old referer CVE-2026-9546 Fix available 7.5 HighJune 24, 2026
• curl exposing HTTP/3 early data CVE-2026-9545 Fix available 7.5 HighJune 24, 2026
• curl UAF after pause in socket callback CVE-2026-9080 Fix available 7.3 HighJune 24, 2026
• curl stale proxy password leak CVE-2026-9079 Fix available 9.8 CriticalJune 24, 2026
• curl incomplete mTLS config matching in conn reuse CVE-2026-8932 Public exploitFix available 7.5 HighJune 24, 2026
• curl env-set cross-proxy Digest auth state leak CVE-2026-8927 Fix available 9.1 CriticalJune 24, 2026
• curl password leak with netrc and user in URL CVE-2026-8926 Fix available 9.1 CriticalJune 24, 2026
• curl SASL double-free CVE-2026-8925 Fix available 9.8 CriticalJune 24, 2026
• curl trailing dot domain super cookie CVE-2026-8924 Fix available 9.1 CriticalJune 24, 2026
• curl wrong reuse for different services CVE-2026-8458 Fix available 6.5 MediumJune 24, 2026
• curl wrong STARTTLS connection reuse CVE-2026-8286 Fix available 8.1 HighJune 24, 2026
• curl proto-default skips SSH verification CVE-2026-12064 Fix available 7.5 HighJune 24, 2026
• curl cross-origin Digest auth state leak CVE-2026-11856 Fix available 9.8 CriticalJune 24, 2026
• curl WS Auto-PONG memory exhaustion CVE-2026-11586 Fix available 7.5 HighJune 24, 2026
• curl Native CA trust persist CVE-2026-11564 Fix available 9.1 CriticalJune 24, 2026
• curl QUIC zero-length UDP datagrams busy-loop CVE-2026-11352 Fix available 7.5 HighJune 24, 2026
• Show olderLoading…