ROOT-OS-ALPINE-321-CVE-2026-11856 CVE-2026-11856 in curl - Patched by Root

Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-9079 CVE-2026-9079 in curl - Patched by Root

Root has patched CVE-2026-9079 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-9545 CVE-2026-9545 in curl - Patched by Root

Root has patched CVE-2026-9545 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-80229 CVE-2026-80229 in curl - Patched by Root

Root has patched CVE-2026-80229 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-80231 CVE-2026-80231 in curl - Patched by Root

Root has patched CVE-2026-80231 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-8932 CVE-2026-8932 in curl - Patched by Root

Root has patched CVE-2026-8932 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-80255 CVE-2026-80255 in curl - Patched by Root

Root has patched CVE-2026-80255 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-12064 CVE-2026-12064 in curl - Patched by Root

Root has patched CVE-2026-12064 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-8926 CVE-2026-8926 in curl - Patched by Root

Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

curl: SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections

The core effect is a silent host-authentication bypass: a transfer whose configured SSH host-key policy would reject the server is served anyway, with exit code 0 and no warning, because it reuses a pooled connection established under a weaker or absent policy. curl may assess this lower because ...

Ubuntu 26.04 LTS : curl vulnerabilities (USN-8927-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8927-1 advisory. It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this...

PT-2026-117325

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : curl vulnerabilities (USN-8932-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8932-1 advisory. Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when...

curl: OpenSSL `--cert-status` accepts indefinitely stale GOOD OCSP staples

Summary When curl uses its OpenSSL backend with CURLOPTSSLVERIFYSTATUS the --cert-status tool option, a correctly signed OCSP response can be accepted forever if its optional nextUpdate field is absent. curl passes -1 as OpenSSL's maximum permitted age for thisUpdate, explicitly disabling the onl...

curl: Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc caches

Affected Component - lib/curlfopen.c, Curlfopen, line 98: curlxfopenfilename, FOPENWRITETEXT - Callers: lib/cookie.c:1543 cookie jar save, lib/hsts.c:390 HSTS save, lib/altsvc.c:415 alt-svc save - CLI entry points: -c / --cookie-jar src/config2setopts.c:575, --hsts FILE :714, --alt-svc FILE :711...

curl: curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode)

Summary curl's non-blocking connection shutdown machinery lib/cshutdn.c is supposed to enforce a 2-second shutdown timeout DEFAULTSHUTDOWNTIMEOUTMS on connections whose peer never answers the graceful shutdown. In curlmultisocketaction event-driven mode the machinery deadlocks: the only code that...

curl: netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections)

Summary curl's redirect credential-leak protection the CURLOPTUNRESTRICTEDAUTH off-by-default guarantee, enforced by Curlauthallowedtoorigin covers three credential sources: a custom Authorization header, CURLOPTUSERNAME/CURLOPTPASSWORD, and cookies. It does not cover credentials read from a .net...

curl: CVE-2026-111951: curl -OJ truncate without filename

In curl versions 8.23.0, 8.22.0, and master branch, a vulnerability was identified in the tool's handling of Content-Disposition headers with the -OJ flag. When a response contained multiple Content-Disposition headers where the first lacked a filename parameter, the tool would create and truncat...

curl: WebSocket send queue use-after-free during nested curl_ws_send()

At lib/ws.c:1734, wsflush borrows a pointer from the outgoing sendbuf and passes it to wssendrawblocking; it skips those bytes only after the send returns. A curlwssend from the WebSocket write callback can be interrupted by a TCP-trace debug callback that calls curlwssend again, and the nested...

curl: SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connection

Summary For SCP/SFTP, curl verifies the server's host key once, during the initial connect state machine, in sshcheckfingerprint — which reads CURLOPTSSHHOSTPUBLICKEYSHA256 / MD5, the CURLOPTSSHKNOWNHOSTS file, and the CURLOPTSSHHOSTKEYFUNCTION callback. That function has exactly one caller,...