12811 matches found
curl resource management error vulnerability
The Curl version 7.21.0 to 8.22.0 contains a resource management vulnerability. This vulnerability arises from the failure of FTP wildcard LIST operations, which does not restore the write callback properly. As a result, the write callback is set to an internal parser, and the data written by the...
curl information leakage vulnerability
The curl version 7.75.0 to 8.21.0 has a vulnerability related to information leakage. This vulnerability arises when CURLOPTAWSSIGV4 is set to NULL without disabling SigV4 authentication. As a result, the same request’s subsequent transmissions still send the Authorization: AWS4-HMAC-SHA256 heade...
Improper curl exception handling vulnerability
Versions 8.22.0, 8.21.0, 8.20.0, 8.19.0, and 8.18.0 of curl contain a vulnerability related to improper exception handling. This vulnerability arises because a remote HTTP server can set curl to accept and write Netscape cookie jars but cannot reload them. When the same path is used for --cookie...
Curl input validation vulnerability
The curl version 8.7.0 to 8.22.0 has a vulnerability related to input validation errors. This vulnerability arises from writing overly long cookie names and values into the Netscape cookie jar, exceeding the line length limit. As a result, when using the --cookie option to read the same cookie ja...
Curl encryption vulnerability
The curl version 7.81.0 to 8.22.0 has an encryption-related vulnerability. This vulnerability stems from logical flaws in the curl command-line tool. As a result, the SSH host authentication option is only set when using direct SFTP or SCP interactions. However, it is not set during redirection,...
Curl encryption issue vulnerability
Versions 8.22.0 and earlier of curl contain an encryption vulnerability. This vulnerability arises when, during TLS handshake, curl re-parses the same certificate; due to manipulation of the validity length field, it extracts and matches a different embedded key while incorrectly authorizing the...
curl resource management error vulnerability
The curl versions 8.10.0, 8.10.1, 8.11.0, 8.11.1, 8.12.0, 8.12.1, 8.13.0, 8.14.0, 8.14.1, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 8.20.0, 8.21.0, and 8.22.0 have a resource management error vulnerability. This vulnerability arises from malicious FTP, IMAP, POP3, or SMTP servers that completely...
Curl session mechanism vulnerabilities
Curl versions 8.21.0 and earlier have a session mechanism vulnerability. This vulnerability arises from the fact that the ftp:// transfer, configured with CURLESSLNONE, reuses the previously upgraded and client-certified pool-based FTP control connection via STARTTLS. The second handle does not...
USN-8927-2 curl vulnerabilities
USN-8927-1 fixed vulnerabilities in curl. This update provides the corresponding fixes for Ubuntu 26.10. Original advisory details: It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtai...
USN-8927-2: curl vulnerabilities
USN-8927-1 fixed vulnerabilities in curl. This update provides the corresponding fixes for Ubuntu 26.10. Original advisory details: It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtai...
curl: urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the host
Summary: six or fewer sentences describing the issue in your own human voice and optionally a short proof-of-concept script An app can set a host from untrusted input from CURLUPARTHOST, as the docs allow, and rely on curl to reject bad hosts. curl accepts fe80::1%[email protected]/x as a valid...
curl: wolfSSL Backend Silently Ignores --cert-status (OCSP Stapling Bypass)
Summary When curl is built with the wolfSSL TLS backend, --cert-status CURLOPTSSLVERIFYSTATUS is silently accepted and ignored. The wolfSSL backend sets certstatusrequest = NULL in its vtable lib/vtls/wolfssl.c:2309, meaning OCSP stapling is not implemented. The curleasysetopt call returns...
curl: Derived cookie Path aborts cookie jar loading in curl 8.23.0
Hello curl security team, I am reporting a related cookie-jar failure that I reproduced on the official curl 8.23.0 release. Summary A server redirects curl to a path approximately 5 KB long and responds there with a short cookie that has no Path attribute. curl derives the cookie path from the...
ROOT-OS-ALPINE-322-CVE-2026-10536 CVE-2026-10536 in curl - Patched by Root
Root has patched CVE-2026-10536 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...
ROOT-OS-ALPINE-322-CVE-2026-80230 CVE-2026-80230 in curl - Patched by Root
Root has patched CVE-2026-80230 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...
ROOT-OS-ALPINE-322-CVE-2026-82208 CVE-2026-82208 in curl - Patched by Root
Root has patched CVE-2026-82208 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...
ROOT-OS-ALPINE-322-CVE-2026-13608 CVE-2026-13608 in curl - Patched by Root
Root has patched CVE-2026-13608 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...
ROOT-OS-ALPINE-322-CVE-2026-18924 CVE-2026-18924 in curl - Patched by Root
Root has patched CVE-2026-18924 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...