Red Hat: CVE-2026-86414: curl: curl: leaking host credentials to HTTP proxy

An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...

Red Hat: CVE-2026-92391: curl: curl: curl_mime_free stack overflow by recursion

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process...

Ubuntu: USN-8927-1 (CVE-2026-87865): curl vulnerabilities

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

Ubuntu: USN-8927-1 (CVE-2026-107928): curl vulnerabilities

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutlsrecordsend returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked...

Red Hat: CVE-2026-92390: curl: curl: -J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

Red Hat: CVE-2026-92389: curl: curl: TFTP direction confusion

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

Red Hat: CVE-2026-92388: curl: curl: FTP wildcard write callback mixup

When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash,...

RHEL 10 : curl (RHSA-2026:80512)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80512 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including...

Red Hat: CVE-2026-86409: curl: curl: stale SigV4 headers sent unintended

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

Red Hat: CVE-2026-94266: curl: curl: password leak in CURLINFO_EFFECTIVE_URL

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

RHEL 9 : curl (RHSA-2026:80511)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80511 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including...

Ubuntu: USN-8927-1 (CVE-2026-86412): curl vulnerabilities

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...

Ubuntu: USN-8927-1 (CVE-2026-92386): curl vulnerabilities

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

Ubuntu: USN-8927-1 (CVE-2026-86410): curl vulnerabilities

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

Fedora 43 : curl (2026-d65da12723)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d65da12723 advisory. - fix incomplete mTLS config matching in conn reuse CVE-2026-8932 - fix OpenLDAP SASL authentication bypass CVE-2026-13608 - fix OpenSSL pinning...

AlmaLinux 9 : curl (ALSA-2026:80511)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:80511 advisory. curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure via incorrect Digest...

AlmaLinux 10 : curl (ALSA-2026:80512)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:80512 advisory. curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies CVE-2026-6253 curl: libcurl: Authentication bypass due to incorrect HTT...

CentOS 9 : curl-7.76.1-44.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the curl-7.76.1-44.el9 build changelog. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

Red Hat: CVE-2026-87864: curl: IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

Fedora 44 : curl (2026-91d799048a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-91d799048a advisory. - Fix Negotiate ambient user conn reuse CVE-2026-19931 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...