12808 matches found
CVE-2026-86411
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
CVE-2026-86410
A logic flaw in the curl command line tool causes it to fail to set SSH host verification options when following a redirect to SFTP or SCP URLs. While host verification is correctly applied during direct interaction with these protocols, the failure to apply it during redirects could allow an att...
CVE-2026-86410 redirect to SFTP or SCP bypasses host verification
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
EUVD-2026-105275
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
CVE-2026-86410
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...
Malicious code in memories-core-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5aa2bc32ff519468287f8a87deeff1349332b710735b9f78ee34ffd46c9511cb package.json declares a preinstall lifecycle script that runs curl to a hardcoded webhook.site collector URL...
curl: POP3: data after the end-of-body terminator is written into the retrieved message
Vulnerability Information When a POP3 server sends the end-of-body terminator and further data in the same read, curl writes the bytes after the terminator into the retrieved message's output file and still reports success. The PoC returns the message, its "." line, and then a second "+OK" respon...
curl: A server response that answers nothing is used as the next transfer's reply — and with IMAP, a fully compliant server does this by accident
Name: Maturi Jaswanth Sai Madhu Mohan Product: curl / libcurl — all four pingpong protocols demonstrated: IMAP, POP3, SMTP and FTP — the same protocol set curl's own CVE-2026-92387 names Affected: reproduced on current git master dbb8262a9c 8.23.1-DEV, fetched and rebuilt today, on d1d4b5931a, on...
K000163787: curl vulnerability CVE-2026-92392
Security Advisory Description During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object. CVE-2026-92392 Impact There is no impact; F5 products are not affected by this...
curl: server filename with control characters printed to terminal (`-J`)
Summary: With -OJ, curl takes the filename from the server's Content-Disposition header. parsefilename in src/toolcbhdr.c does not remove control characters such as ESC 0x1b. When a warning prints that name, the escape sequences reach the terminal. Steps to reproduce 1. Build curl from the source...
curl: HSTS cache file: three trailing dots silently disable HSTS for that host
Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/hsts.c Affected: curl 8.20.0, 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295 / CWE-693, an HSTS pin that silently stops applying Before we...
curl: TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another
Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/vtls/vtlsscache.c Affected: curl 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295, wrong client identity on a resumed TLS session. Same class ...
Ubuntu: (Multiple Advisories) (CVE-2026-87862): curl vulnerabilities
Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...
Red Hat: CVE-2026-86409: curl: curl: stale SigV4 headers sent unintended
Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...
Red Hat: CVE-2026-92388: curl: curl: FTP wildcard write callback mixup
When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash,...
Ubuntu: USN-8927-1 (CVE-2026-87865): curl vulnerabilities
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
Red Hat: CVE-2026-86414: curl: curl: leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
Red Hat: CVE-2026-92391: curl: curl: curl_mime_free stack overflow by recursion
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process...