CVE-2026-87866

A flaw in curl allows a malicious server to bypass public key pinning when the application is built with the wolfSSL backend. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the certificate—tricked by a manipulated validity length field —extracts an...

CVE-2026-87863

The curl utility (versions prior to 8.23.0 ) is vulnerable to a data loss vulnerability. An authenticated HTTPS origin can provide an HSTS max-age value that the parser accepts but fails during time serialization. On 64-bit systems , extreme max-age values result in absolute expiry values that ex...

CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS "max-age" value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cac...

CVE-2026-87863 HSTS response erases persisted entries

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

CVE-2026-87864 IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

EUVD-2026-105310

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-87864

Enabling "CURLOPTCRLF" causes curl to advertise the raw input byte count in the "IMAP APPEND N" literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands...

CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-87864

The curl library is vulnerable to a command injection vulnerability when using the CURLOPT_CRLF option. The root cause is that curl advertises the raw input byte count in the IMAP APPEND {N} literal while transmitting line-ending expanded data. Because the server only reads $N$ bytes for the payl...

CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-87862

Importing a "includeSubDomains" parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...

EUVD-2026-105309

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...

CVE-2026-87862 HSTS cache import drops longer-lived child

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...

CVE-2026-87862

The curl utility (versions prior to 8.23.0 ) is vulnerable to a policy handling flaw where importing an includeSubDomains parent HSTS entry before a longer-lived child entry results in the child entry being silently dropped. This causes the child's valid HSTS policy to be lost upon the parent's e...

CVE-2026-87862

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...

CVE-2026-87862

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...

EUVD-2026-105279

When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...

CVE-2026-86413 Negotiate credentials sent to redirected origin

When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...