Skip to contentCurl vulnerabilities
Newest
- curlHTTP/2 stream-dependency tree UAFCVE-2026-10536Fix available9.8 Critical
- curlOCSP stapling bypass with Apple SecTrustCVE-2026-7009Fix available5.3 Medium
- curlnetrc credential leak with reused proxy connectionCVE-2026-6429Fix available5.3 Medium
- curlstale custom cookie host causes cookie leakCVE-2026-6276Fix available7.5 High
- curlproxy credentials leak over redirect-to proxyCVE-2026-6253Fix available5.9 Medium
- curlwrong reuse of SMB connectionCVE-2026-5773Fix available7.5 High
- curlwrong reuse of HTTP Negotiate connectionCVE-2026-5545Fix available6.5 Medium
- curlconnection reuse ignores TLS requirementCVE-2026-4873Fix available5.9 Medium
- curlcross-proxy Digest auth state leakCVE-2026-7168Fix available5.3 Medium
- curluse after free in SMB connection reuseCVE-2026-3805Public exploitFix available7.5 High
- curl, siemens ruggedcom rst2428p +1 morewrong proxy connection reuse with credentialsCVE-2026-3784Fix available6.5 Medium
- curltoken leak with redirect and netrcCVE-2026-3783Fix available5.3 Medium
- curlbad reuse of HTTP Negotiate connectionCVE-2026-1965Fix available6.5 Medium
- curlbroken TLS options for threaded LDAPSCVE-2025-14017Fix available6.3 Medium
- curllibssh key passphrase bypass without agent setCVE-2025-15224Fix available3.1 Low
- curllibssh global known_hosts overrideCVE-2025-15079Fix available5.3 Medium
- curlOpenSSL partial chain store policy bypassCVE-2025-14819Fix available5.3 Medium
- curlbearer token leak on cross-protocol redirectCVE-2025-14524Fix available5.3 Medium
- curlNo QUIC certificate pinning with GnuTLSCVE-2025-13034Fix available5.9 Medium
- curl, curl wcurl +1 morewcurl path traversal with percent-encoded slashesCVE-2025-11563Fix available4.6 Medium
- curl, siemens ruggedcom rst2428p +1 moremissing SFTP host verification with wolfSSHCVE-2025-10966Fix available4.3 Medium
- curlpredictable WebSocket maskCVE-2025-10148Fix available5.3 Medium
- curl, debian linux, siemens ruggedcom rst2428p +15 more +17 moreOut of bounds read for cookie pathCVE-2025-9086Fix available7.5 High
- curlWebSocket endless loopCVE-2025-5399Fix available7.5 High
- curlNo QUIC certificate pinning with wolfSSLCVE-2025-5025Public exploitFix available4.8 Medium
- curlQUIC certificate check skip with wolfSSLCVE-2025-4947Fix available6.5 Medium
- curl, haxx libcurl, netapp hci baseboard management controller +24 more +26 moregzip integer overflowCVE-2025-0725Fix available7.3 High
- curl, netapp bootstrap os, h300s firmware +23 more +25 moreeventfd double closeCVE-2025-0665Fix available7.0 High
- curl, netapp bootstrap os, element software +32 more +34 morenetrc and default credential leakCVE-2025-0167Fix available3.4 Low
- curl, netapp bootstrap os, h300s firmware +29 more +31 morenetrc and redirect credential leakCVE-2024-11053Fix available3.4 Low
- curlHSTS subdomain overwrites parent cache entryCVE-2024-9681Fix available6.5 Medium
- curl, debian linux, netapp active iq unified manager +26 more +28 moreOCSP stapling bypass with GnuTLSCVE-2024-8096Fix available6.5 Medium
- curl, haxx libcurl, siemens ruggedcom rst2428p +19 more +21 moreASN.1 date parser overreadCVE-2024-7264Fix availableEPSS 20.2%6.5 Medium
- curl, curl libcurl +1 moremacidn punycode buffer overreadCVE-2024-6874Fix available4.3 Medium
- curl, haxx libcurl +1 morefreeing stack buffer in utf8asn1strCVE-2024-6197Fix available7.5 High
- curl, curl libcurl, apple macos +10 more +12 moreTLS certificate check bypass with mbedTLSCVE-2024-2466Fix available6.5 Medium
- curl, apple macos, netapp active iq unified manager +14 more +16 moreQUIC certificate check bypass with wolfSSLCVE-2024-2379Fix available6.3 Medium
- curl, apple macos, fedoraproject fedora +16 more +18 moreHTTP/2 push headers memory-leakCVE-2024-2398Fix availableEPSS 36.1%8.6 High
- curl, apple macos, fedoraproject fedora +12 more +14 moreUsage of disabled protocolCVE-2024-2004Fix available3.5 Low
- curlOCSP verification bypass with TLS session reuseCVE-2024-0853Fix available5.3 Medium
- curl, fedoraproject fedora, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +3 more +5 moreWhen saving HSTS data to an excessively long file name, curl could end up
removing all contents,...CVE-2023-46219Fix available5.3 Medium
- curl, fedoraproject fedora, siemens ruggedcom rox mx5000 +14 more +16 moreThis flaw allows a malicious HTTP server to set "super cookies" in curl that
are then passed back...CVE-2023-46218Fix available6.5 Medium
- curl, haxx libcurl, siemens ruggedcom ape1808 +3 more +5 moreThis flaw allows an attacker to insert cookies at will into a running program
using libcurl, if...CVE-2023-38546Fix available3.7 Low
- curl, fedoraproject fedora, haxx libcurl +15 more +17 moreThis flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
handshake.
When curl is...CVE-2023-38545Public exploitFix availableEPSS 78.3%9.8 Critical
- curl, fedoraproject fedora, microsoft windows 10 1809 +7 more +9 moreWhen curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed...CVE-2023-38039Public exploitFix availableEPSS 56.2%7.5 High
- curlCurl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local...CVE-2016-46069.8 Critical
- curl, debian linux, fedoraproject fedora +17 more +19 moreHeap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.CVE-2019-5482Fix availableEPSS 17.9%9.8 Critical
- curl, debian linux, fedoraproject fedora +12 more +14 moreDouble-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.CVE-2019-5481Fix available9.8 Critical
- curl, netapp oncommand insight, oncommand unified manager +9 more +11 moreA non-privileged user or program can put code and a config file in a known non-privileged path ...CVE-2019-54437.8 High
- curl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreAn integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and...CVE-2019-5435Fix available3.7 Low
- Show moreLoading…