138102 matches found
DEBIAN-CVE-2026-92392
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
CVE-2026-92392
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
Security Bulletin: IBM Guardium Data Protection is affected by a Denial-of-Service (DoS) vulnerability in Micrometer (CVE-2026-40984)
Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Affected versions:...
Strutscli
StrutsExp Usage strutsexp http://example.com/index.action...
server-set cookie aborts cookie jar load
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...
server-set cookie erases cookie jar
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...
HSTS cache import drops longer-lived child
Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...
leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
HTTP/2 upload Use-After-Free
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
CURL-CVE-2026-86412 server-set cookie erases cookie jar
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...
CURL-CVE-2026-87862 HSTS cache import drops longer-lived child
Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...
CURL-CVE-2026-86414 leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CURL-CVE-2026-92392 HTTP/2 upload Use-After-Free
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
CURL-CVE-2026-94265 Authorization: Negotiate sent to foreign origin
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
EUVD-2026-100915
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
CVE-2026-92392
During an upload, curl mishandles HTTP/2 "RSTSTREAM" received from the server with reason "HTTP11REQUIRED" or "REFUSEDSTREAM" leading to a use after free of a "struct Curleasy" object...
CVE-2026-92392
The curl library (version 8.22.0 and earlier) contains a high-severity Use-After-Free vulnerability in its HTTP/2 upload handling. The flaw occurs when a server sends an RST_STREAM frame with the reason HTTP_1_1_REQUIRED or REFUSED_STREAM during a file upload. If the upload contains specific char...
CVE-2026-92392 HTTP/2 upload Use-After-Free
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...
