12914 matches found
curl:curl_fuzzer_proto_http2: Heap-use-after-free in on_stream_close
Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=6471909408309248 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerprotohttp2 Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x75f4361e72...
PT-2026-98285
Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description PHP contains an issue where credentials could be leaked during a redirect when using curl. This occurs when the application follows a redirect to an external host and inadvertently includes...
CLSA-2026-1790154364 curl: Fix of 3 CVEs
CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...
curl: Missing applicability validation allows non-applicable HTTPS RR to reach ECH processing
Summary The HTTPS RR applicability check Curlhttpsrrapplicable is applied before ALPN selection, but the same check is not applied consistently in the ECH initialization paths. When an HTTPS RR is not applicable to the active connection, curl correctly reports it as not applicable and avoids usin...
CLSA-2026-1790152441 curl: Fix of 3 CVEs
CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...
curl security update
8.12.1-4.6 - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856 - fix netrc password lookup for non-matching login CVE-2026-8926 8.12.1-4.5 - fix proxy auth not cleared properly on NULL CVE-2026-9079 - fix...
Oracle Linux 10 : curl (ELSA-2026-69125)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69125 advisory. - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856 - fix...
curl security update
An update is available for curl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...
RLSA-2026:69126 Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...
curl security update
An update is available for curl. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for...
RLSA-2026:69125 Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: curl: Information...
CVE-2026-80255
A flaw was found in curl. When a Set-Cookie: header uses a tab character instead of a space before the Secure attribute, curl incorrectly stores the cookie without the Secure flag. This can lead to information disclosure, as the cookie may then be sent over unencrypted HTTP connections to the sam...
Malicious code in @uol-afiliados/affiliated-config-lib (npm)
Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl against a subdomain of...
AlmaLinux 10 : curl (ALSA-2026:69125)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69125 advisory. libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: curl: Information disclosure via incorrect .netrc...
AlmaLinux 9 : curl (ALSA-2026:69126)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69126 advisory. curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to uncleared proxy authentication stat...
RockyLinux 9 : curl (RLSA-2026:69126)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69126 advisory. curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to uncleared proxy authentication sta...
RockyLinux 10 : curl (RLSA-2026:69125)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69125 advisory. libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: curl: Information disclosure via incorrect .netrc...
Important: Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
Security Bulletin: Multiple vulnerabilities impacts AIX due to cURL libcurl.
Summary Multiple vulnerabilities in the curl/libcurl are related to reuse existing unencrypted connection CVE-2026-4873, credentials leakage CVE-2026-6253, CVE-2026-6429, CVE-2026-7168, cookies leakageCVE-2026-6276. Vulnerability Details CVEID:CVE-2026-4873 DESCRIPTION: A vulnerability exists whe...
curl: curl: Cookie injection via malicious HTTP server using super cookies
A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to...