Haxx Curl vulnerabilities

• curl domain-scoped PSL domain cookie CVE-2026-82209 Fix available 8.2 HighSeptember 2, 2026
• curl secure cookie attribute bypass with tab CVE-2026-80255 Fix available 7.5 HighSeptember 2, 2026
• curl OpenSSL pinning bypass CVE-2026-80230 Fix available 7.5 HighSeptember 2, 2026
• curl OpenSSL provider use-after-free CVE-2026-80229 Fix available 7.5 HighSeptember 2, 2026
• curl Negotiate ambient user conn reuse CVE-2026-19931 Fix available 9.8 CriticalSeptember 2, 2026
• curl HTTP/2 server push UAF CVE-2026-18924 Fix available 9.1 CriticalSeptember 2, 2026
• curl OpenLDAP SASL authentication bypass CVE-2026-13608 Fix available 7.4 HighSeptember 2, 2026
• curl wolfSSL CA-cache hit overrides callback CVE-2026-82208 Fix available 7.5 HighSeptember 2, 2026
• curl native CA store conn reuse CVE-2026-80231 Fix available 7.5 HighSeptember 2, 2026
• curl SSH improper host validation CVE-2026-9547 Fix available 7.4 HighJune 24, 2026
• curl sending old referer CVE-2026-9546 Fix available 7.5 HighJune 24, 2026
• curl exposing HTTP/3 early data CVE-2026-9545 Fix available 7.5 HighJune 24, 2026
• curl UAF after pause in socket callback CVE-2026-9080 Fix available 7.3 HighJune 24, 2026
• curl stale proxy password leak CVE-2026-9079 Fix available 9.8 CriticalJune 24, 2026
• curl incomplete mTLS config matching in conn reuse CVE-2026-8932 Public exploitFix available 7.5 HighJune 24, 2026
• curl env-set cross-proxy Digest auth state leak CVE-2026-8927 Fix available 9.1 CriticalJune 24, 2026
• curl password leak with netrc and user in URL CVE-2026-8926 Fix available 9.1 CriticalJune 24, 2026
• curl SASL double-free CVE-2026-8925 Fix available 9.8 CriticalJune 24, 2026
• curl trailing dot domain super cookie CVE-2026-8924 Fix available 9.1 CriticalJune 24, 2026
• curl wrong reuse for different services CVE-2026-8458 Fix available 6.5 MediumJune 24, 2026
• curl wrong STARTTLS connection reuse CVE-2026-8286 Fix available 8.1 HighJune 24, 2026
• curl proto-default skips SSH verification CVE-2026-12064 Fix available 7.5 HighJune 24, 2026
• curl cross-origin Digest auth state leak CVE-2026-11856 Fix available 9.8 CriticalJune 24, 2026
• curl WS Auto-PONG memory exhaustion CVE-2026-11586 Fix available 7.5 HighJune 24, 2026
• curl Native CA trust persist CVE-2026-11564 Fix available 9.1 CriticalJune 24, 2026
• curl QUIC zero-length UDP datagrams busy-loop CVE-2026-11352 Fix available 7.5 HighJune 24, 2026
• curl HTTP/2 stream-dependency tree UAF CVE-2026-10536 Fix available 9.8 CriticalJune 24, 2026
• curl OCSP stapling bypass with Apple SecTrust CVE-2026-7009 Fix available 5.3 MediumApril 29, 2026
• curl netrc credential leak with reused proxy connection CVE-2026-6429 Fix available 5.3 MediumApril 29, 2026
• curl stale custom cookie host causes cookie leak CVE-2026-6276 Fix available 7.5 HighApril 29, 2026
• curl proxy credentials leak over redirect-to proxy CVE-2026-6253 Fix available 5.9 MediumApril 29, 2026
• curl wrong reuse of SMB connection CVE-2026-5773 Fix available 7.5 HighApril 29, 2026
• curl wrong reuse of HTTP Negotiate connection CVE-2026-5545 Fix available 6.5 MediumApril 29, 2026
• curl connection reuse ignores TLS requirement CVE-2026-4873 Fix available 5.9 MediumApril 29, 2026
• curl cross-proxy Digest auth state leak CVE-2026-7168 Fix available 5.3 MediumApril 29, 2026
• curl use after free in SMB connection reuse CVE-2026-3805 Public exploitFix available 7.5 HighMarch 11, 2026
• curl, siemens ruggedcom rst2428p +1 more wrong proxy connection reuse with credentials CVE-2026-3784 Fix available 6.5 MediumMarch 11, 2026
• curl token leak with redirect and netrc CVE-2026-3783 Fix available 5.3 MediumMarch 11, 2026
• curl bad reuse of HTTP Negotiate connection CVE-2026-1965 Fix available 6.5 MediumMarch 11, 2026
• curl broken TLS options for threaded LDAPS CVE-2025-14017 Fix available 6.3 MediumJanuary 7, 2026
• curl libssh key passphrase bypass without agent set CVE-2025-15224 Fix available 3.1 LowJanuary 6, 2026
• curl libssh global known_hosts override CVE-2025-15079 Fix available 5.3 MediumJanuary 6, 2026
• curl OpenSSL partial chain store policy bypass CVE-2025-14819 Fix available 5.3 MediumJanuary 6, 2026
• curl bearer token leak on cross-protocol redirect CVE-2025-14524 Fix available 5.3 MediumJanuary 6, 2026
• curl No QUIC certificate pinning with GnuTLS CVE-2025-13034 Fix available 5.9 MediumJanuary 6, 2026
• curl, siemens ruggedcom rst2428p +1 more missing SFTP host verification with wolfSSH CVE-2025-10966 Fix available 4.3 MediumNovember 5, 2025
• curl predictable WebSocket mask CVE-2025-10148 Fix available 5.3 MediumSeptember 10, 2025
• curl, debian linux, siemens ruggedcom rst2428p +15 more +17 more Out of bounds read for cookie path CVE-2025-9086 Fix available 7.5 HighSeptember 10, 2025
• curl WebSocket endless loop CVE-2025-5399 Fix available 7.5 HighJune 4, 2025
• curl No QUIC certificate pinning with wolfSSL CVE-2025-5025 Public exploitFix available 4.8 MediumMay 28, 2025
• Show olderLoading…