144142 matches found
CVE-2026-92392
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
[SECURITY] [DSA 6558-1] curl security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6558-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 14, 2026 https://www.debian.org/security/faq -...
CVE-2026-92392
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
CVE-2026-92390
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-87862
Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...
UBUNTU-CVE-2026-86412
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...
UBUNTU-CVE-2026-92390
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
UBUNTU-CVE-2026-86414
A HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
UBUNTU-CVE-2026-87862
Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...
UBUNTU-CVE-2026-92392
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
CVE-2026-87861
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unutilized...
CVE-2026-86414
A HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body upload
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
Important: Red Hat Security Advisory: libsoup3 security update
An update for libsoup3 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...
CVE-2026-107718
A flaw was found in AdonisJS HTTP Server. The route URL generation helper fails to properly encode parameter values when constructing redirect destinations. A remote attacker can exploit this flaw by supplying a crafted path parameter starting with a forward slash, generating a scheme-relative...
CLEANSTART-2026-FF99068 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server...
CLEANSTART-2026-DQ31365 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server)
CVE-2022-21628 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Lightweight HTTP Server. See references for individual vulnerability details...
