12808 matches found
CVE-2026-86413
The curl utility is vulnerable to a credential leakage flaw when using an ambient user during a first transfer utilizing Negotiate authentication . If the client is instructed to follow redirects, it may incorrectly pass its credential details to an unrelated second origin. This vulnerability is ...
CVE-2026-86413
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
CVE-2026-86413
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
CVE-2026-86413
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
CVE-2026-86412
The curl utility (versions prior to 8.23.0 ) is vulnerable to a data loss flaw where a remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On subsequent invocations using the same path for --cookie and --cookie-jar, curl fails before connec...
CVE-2026-86412 server-set cookie erases cookie jar
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...
CVE-2026-86412
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...
EUVD-2026-105277
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...
CVE-2026-86412
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for "--cookie" and "--cookie-jar", curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cooki...
CVE-2026-86412
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...
CVE-2026-86411
The curl utility (specifically versions like 8.23.0-1.1 on openSUSE Tumbleweed) is vulnerable to a connection reuse issue. An ftp:// transfer using CURLUSESSL_NONE can reuse a pooled FTP control connection previously upgraded with STARTTLS and authenticated via a client certificate. Because the s...
CVE-2026-86411 FTP connection reuse inherits client-certificate
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
CVE-2026-86411
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
CVE-2026-86411
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
CVE-2026-86410
A logic flaw in the curl command line tool causes it to fail to set SSH host verification options when following a redirect to SFTP or SCP URLs. While host verification is correctly applied during direct interaction with these protocols, the failure to apply it during redirects could allow an att...
CVE-2026-86410 redirect to SFTP or SCP bypasses host verification
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
EUVD-2026-105275
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...