Ubuntu: USN-8927-1 (CVE-2026-107929): curl vulnerabilities

When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...

Ubuntu: USN-8927-1 (CVE-2026-86412): curl vulnerabilities

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...

Ubuntu: USN-8927-1 (CVE-2026-92386): curl vulnerabilities

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

Fedora 44 : curl (2026-91d799048a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-91d799048a advisory. - Fix Negotiate ambient user conn reuse CVE-2026-19931 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Ubuntu: USN-8927-1 (CVE-2026-86410): curl vulnerabilities

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

RHEL 10 : curl (RHSA-2026:80512)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80512 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including...

Red Hat: CVE-2026-92388: curl: curl: FTP wildcard write callback mixup

When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash,...

RHEL 9 : curl (RHSA-2026:80511)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80511 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including...

Ubuntu: (Multiple Advisories) (CVE-2026-87862): curl vulnerabilities

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...

Red Hat: CVE-2026-87863: curl: curl: Hsts Response Erases Persisted Entries

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

Red Hat: CVE-2026-92390: curl: curl: -J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

Red Hat: CVE-2026-94266: curl: curl: password leak in CURLINFO_EFFECTIVE_URL

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

Red Hat: CVE-2026-87864: curl: IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

Red Hat: CVE-2026-92389: curl: curl: TFTP direction confusion

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

AlmaLinux 10 : curl (ALSA-2026:80512)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:80512 advisory. curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies CVE-2026-6253 curl: libcurl: Authentication bypass due to incorrect HTT...

AlmaLinux 9 : curl (ALSA-2026:80511)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:80511 advisory. curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure via incorrect Digest...

CentOS 9 : curl-7.76.1-44.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the curl-7.76.1-44.el9 build changelog. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

Fedora 43 : curl (2026-d65da12723)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d65da12723 advisory. - fix incomplete mTLS config matching in conn reuse CVE-2026-8932 - fix OpenLDAP SASL authentication bypass CVE-2026-13608 - fix OpenSSL pinning...

curl:curl_fuzzer_proto_ws: Heap-buffer-overflow in SHA256_Update_thunk

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5102160812244992 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerprotows Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x7a2289c2c801...

curl: curl reuses an HTTPS connection when a response is already buffered in the TLS stack

curl master 15292ed75, 8.23.1-DEV reuses an idle HTTP/1.1-over-TLS connection even when a complete extra response is already buffered in OpenSSL/GnuTLS. The ef6b17cf1 fix only polls the socket: Curlcpoolconnseemshealthy lib/conncache.c:1073, called from lib/url.c:1071 uses Curlconnisalive, and...