curl: Pinned public key check passes for a key the server does not hold with the wolfSSL backend

Summary: With the wolfSSL backend, --pinnedpubkey is checked against a public key that curl extracts by re-parsing the server certificate with its own ASN.1 parser lib/vtls/x509asn1.c, while wolfSSL verifies the chain with its own parser. curl 8.23.0 added a check that the validity field of the...

curl: CVE-2026-115528: wolfSSL TLS connect without cert

A vulnerability was discovered in curl when built with wolfSSL that allowed TLS connections to complete without certificate verification. When using default certificate verification settings, curl accepted anonymous Diffie-Hellman cipher suites that transmitted no server certificate. This caused...

CLSA-2026-1786027831 curl: Fix of 4 CVEs

CVE-2026-8927: url: detect proxy changes read from environment to flush proxy Digest state - CVE-2026-8932: tls: fix incomplete mTLS config in connection reuse and session cache...

curl trust management issue vulnerability

The curl version 7.62.0 to 8.22.0 has a trust management issue. This issue arises from the CURLOPTEFFECTIVEURL option in curleasygetinfo, which may unexpectedly return a URL containing credentials. This occurs even when the URL provided to libcurl and the redirection URL do not contain credential...

curl information leakage vulnerability

The curl version 7.15.0 to 8.22.0 has a vulnerability involving information leakage. This vulnerability stems from the TFTP state machine not verifying state transitions based on the direction of the requested transmission, allowing for the swapping of read and write responses. A malicious TFTP...

curl information leakage vulnerability

The curl version 7.75.0 to 8.21.0 has a vulnerability related to information leakage. This vulnerability arises when CURLOPTAWSSIGV4 is set to NULL without disabling SigV4 authentication. As a result, the same request’s subsequent transmissions still send the Authorization: AWS4-HMAC-SHA256 heade...

curl information leakage vulnerability

The curl versions 8.11.0, 8.11.1, 8.12.0, 8.12.1, 8.13.0, 8.14.0, 8.14.1, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 8.20.0, 8.21.0, and 8.22.0 have a vulnerability involving information leakage. This vulnerability stems from improper handling of the order in which HSTS entries are imported. When th...

Curl encryption vulnerability

The curl version 8.22.0 and earlier have an encryption-related vulnerability. This vulnerability arises when libcurl uses libssh2 to process the hash of the knownhosts file. In this case, unrelated initial entries can cause host key verification to falsely report a key mismatch as a key absence...

Curl session mechanism vulnerabilities

The Curl version 8.9.0 to 8.22.0 has a vulnerability related to session management mechanisms. This vulnerability arises when the CURLOPTINTERFACE option or the command-line tool’s --interface option uses prefixes like if!, host!, or ifhost to set bindings. As a result, these bindings do not...

curl information leakage vulnerability

The curl 8.22.0 and 8.21.0 versions have a vulnerability involving information leakage. This vulnerability arises from incorrectly retaining and re-transmitting the HTTP Negotiate authentication state of the original host when handling HTTP redirections that contain userinfo. This allows maliciou...

curl buffer error vulnerability

The curl version 7.86.0 to 8.22.0 has a buffer error vulnerability. This vulnerability arises when curl uses GnuTLS for construction, where gnutlsrecordsend returns a number of sent bytes that exceeds the number of incoming bytes sent. This leads to out-of-bounds reading, and malicious WebSocket...

curl information leakage vulnerability

The curl version 8.22.0 and earlier have a vulnerability related to information leakage. This vulnerability arises from the HTTP proxy’s use of the 401 WWW-Authenticate response to CONNECT tunnel requests, instead of the expected 407 Proxy-Authenticate response. This allows licurl to send the...

Improper curl exception handling vulnerability

Versions 8.22.0, 8.21.0, 8.20.0, 8.19.0, and 8.18.0 of curl contain a vulnerability related to improper exception handling. This vulnerability arises because a remote HTTP server can set curl to accept and write Netscape cookie jars but cannot reload them. When the same path is used for --cookie...

curl resource management error vulnerability

The curl version 7.56.0 to 8.22.0 contains a resource management vulnerability. This vulnerability arises from constructing deeply nested multipart MIME structures using public APIs, leading to a libcurl stack overflow during normal cleanup operations. Additionally, the recursive depth of...

Curl input validation vulnerability

The curl version 8.7.0 to 8.22.0 has a vulnerability related to input validation errors. This vulnerability arises from writing overly long cookie names and values into the Netscape cookie jar, exceeding the line length limit. As a result, when using the --cookie option to read the same cookie ja...

Curl encryption vulnerability

The curl version 7.81.0 to 8.22.0 has an encryption-related vulnerability. This vulnerability stems from logical flaws in the curl command-line tool. As a result, the SSH host authentication option is only set when using direct SFTP or SCP interactions. However, it is not set during redirection,...

Curl encryption issue vulnerability

Versions 8.22.0 and earlier of curl contain an encryption vulnerability. This vulnerability arises when, during TLS handshake, curl re-parses the same certificate; due to manipulation of the validity length field, it extracts and matches a different embedded key while incorrectly authorizing the...

curl resource management error vulnerability

The curl versions 8.10.0, 8.10.1, 8.11.0, 8.11.1, 8.12.0, 8.12.1, 8.13.0, 8.14.0, 8.14.1, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 8.20.0, 8.21.0, and 8.22.0 have a resource management error vulnerability. This vulnerability arises from malicious FTP, IMAP, POP3, or SMTP servers that completely...

curl information leakage vulnerability

Curl versions 8.21.0 and earlier, as well as 8.22.0 and earlier, have a vulnerability related to information leakage. This vulnerability arises from the connection caching matching function not considering the automatic client certificate option. As a result, authenticated Schannel connections ma...

curl information leakage vulnerability

The Curl version 8.22.0 and 8.21.0 have a vulnerability related to information leakage. This vulnerability arises when using the ambient user for the first Negotiate authentication transmission and when an redirect is required, it is possible for credential details to be passed to an unrelated...