12808 matches found
EUVD-2026-105353
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a "username:password" component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl...
CVE-2026-94265
The curl tool is vulnerable to a flaw where it may erroneously retain and re-transmit HTTP Negotiate authentication states when processing an HTTP redirect to a URL containing userinfo (a username:password component). This allows a malicious server to trigger a redirect with arbitrary userinfo, f...
CVE-2026-94265 Authorization: Negotiate sent to foreign origin
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
CVE-2026-92390
The curl utility (versions prior to 8.23.0 ) is vulnerable to a local file overwrite flaw when using the --remote-header-name (-J) flag. The root cause is a failure to preserve documented anti-clobbering protections under specific conditions: if an intermediate 103 Early Hints response precedes t...
CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
EUVD-2026-105320
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-92390
When invoked with "--remote-header-name" "-J", curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an "ETag" header is processed before "Content-Disposition" under "--etag-save". This flaw allows an...
CVE-2026-92390
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-92390
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-92386
The curl utility (versions prior to 8.23.0 ) is vulnerable to a cookie jar parsing issue (CWE-1284). A remote HTTP server can force curl to write a record to a Netscape cookie jar that exceeds its line-length parsing limit. This causes subsequent curl invocations using the --cookie flag to silent...
EUVD-2026-105315
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...
CVE-2026-92386 server-set cookie aborts cookie jar load
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...
CVE-2026-92386
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make "curl" write a record that exceeds its line-length parsing limit. Consequently, any subsequent "curl" invocation reading from that same cookie jar using "--cookie" silently aborts parsing prematurely...
CVE-2026-92386
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...
CVE-2026-92386
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...
DEBIAN-CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
AZL-109956 CVE-2026-86409 affecting package curl 8.11.1-11
Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...