curl: RTSP ANNOUNCE/SET_PARAMETER upload with --use-ascii / CURLOPT_TRANSFERTEXT sends more body bytes than the declared Content-Length (incomplete fix of e

Summary curl refuses RTSP uploads that combine a body with --crlf / CURLOPTCRLF, because the LF→CRLF conversion makes the number of bytes actually sent differ from the Content-Length curl declares to the server. That guard was added as a security fix: - RTSP: commit e84f95a "rtsp: refuse doing...

curl: GnuTLS + Apple SecTrust discards authenticated OCSP failure

Summary curl 8.23.0 and current master can accept a TLS certificate despite an explicit CURLOPTSSLVERIFYSTATUS=1 / --cert-status requirement when curl uses the GnuTLS backend together with Apple SecTrust. GnuTLS correctly marks an invalid or revoked stapled OCSP response as invalid. Because a...

curl: WebSocket decoder use-after-free when curl_easy_pause() unpauses from a debug callback

Summary At lib/ws.c:503, wsdecpasspayload holds a pointer into the WebSocket receive queue while passing a frame to the application's write callback. If that callback returns CURLWRITEFUNCPAUSE, the PAUSE requested trace invokes the debug callback before the WebSocket pass consumes those bytes...

curl: SCP upload with --crlf sends more bytes than the size declared to the server (same class curl refused for IMAP CVE-2026-87864 and RTSP)

Summary curl recently started REFUSING uploads that combine a size-declaring protocol with CRLF conversion, because the LF-CRLF expansion makes the number of bytes actually sent differ from the size declared to the server: - IMAP APPEND — CVE-2026-87864, lib/imap.c:885-886: ifdata-set.crlf...

curl: TLS session cache key omits native_ca_store: a session validated with CURLSSLOPT_NATIVE_CA can be resumed by a transfer that disabled it (incomplete f

Summary CVE-2026-11564 fixed the connection pool so that a connection whose certificate was validated with the native CA store is not reused by a later transfer that switched to custom CA material. That same field, nativecastore, is compared for connection reuse but is NOT part of the TLS session...

curl: Redirect to imap/pop3/smtp (SASL) or sftp/scp (libssh) authenticates to the attacker's host with the user's ambient Kerberos credentials

Summary: When curl follows a redirect to an IMAP, POP3 or SMTP URL carrying any userinfo imap://@attacker.example/ is enough, it authenticates to the redirect target with SASL GSSAPI out of the user's default Kerberos credential cache, although no credentials and no authentication method were...

curl: CVE-2026-111954: upload reader failed redirect UAF

Summary: Curlreqhardreset lib/request.c line 124 in curl-8230 calls Curlclientreset while req-rewindread may still be set, which keeps the client reader stack for a rewind lib/sendf.c line 82, and only clears the flag at line 157, so the kept stack is never rewound or freed and is still installed...

curl: CVE-2026-11586 fix is incomplete: auto-PONG memory grows without limit through curl_ws_recv() (CONNECT_ONLY)

Summary: The CVE-2026-11586 fix 849317ff5c, "ws: make pong sending lazy" adds the automatic PONG only when the WebSocket send buffer has room, but it put that check in wsflush lib/ws.c:1712. curlwsrecv, the receive call of the documented CONNECTONLY model, still calls wsencaddpending without it a...

curl: CVE-2026-111953: GnuTLS SecTrust OCSP staple bypass

Summary: When curl is built with GnuTLS and Apple SecTrust, as MacPorts does for curl +gnutls +sectrust, a failed GnuTLS verification is handed to SecTrust, and if SecTrust accepts the chain the GnuTLS result is dropped lib/vtls/gtls.c:1511-1521 in 8.23.0. SecTrust is called without the stapled...

curl: wolfSSL TLS sessions retain native-CA trust after the application narrows trust

Summary In curl 8.23.0 with the wolfSSL backend, a TLS session authenticated while the build-default native CA store is active can be resumed after the application changes the same easy handle to a policy that disables native trust. The second transfer succeeds and exchanges HTTP data even though...

curl: CVE-2026-111950: TLS session cache diff scheme reuse

Summary curl 8.12.0 through 8.23.0 can reuse a TLS session created for an FTPS connection when opening an HTTPS connection to the same hostname and port. The TLS session-cache key contains the hostname, port, transport, TLS backend, and TLS configuration, but it does not contain the URL scheme or...

curl: CRLF injection in the HTTP request-line via `CURLOPT_REQUEST_TARGET` (`--request-target`)

Summary The CURLOPTREQUESTTARGET option string reaches the wire with no CR/LF neutralization, even though it is formatted directly into the HTTP request-line, which is terminated by CRLF. Curlsetstropt lib/setopt.c stores the option string after checking only the 8 MB length cap CURLMAXINPUTLENGT...

curl: CRLF injection in the RTSP request-line and Transport header via `CURLOPT_RTSP_STREAM_URI` and `CURLOPT_RTSP_TRANSPORT`

Summary Two RTSP option strings reach the wire with no CR/LF neutralization, even though each is formatted directly into an RTSP request-line or header field that is terminated by CRLF. Curlsetstropt lib/setopt.c stores each option string after checking only the 8 MB length cap CURLMAXINPUTLENGTH...

curl: curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status line

Summary In the HTTP/1.1 proxy-CONNECT response parser lib/cf-h1-proxy.c, singleheader, the per-line counter data-req.headerline a.k.a. k-headerline is never incremented — only the tunnel-local ts-headerlines is. Curlreqsoftreset resets k-headerline to 0 before the CONNECT exchange begins, and it...

MGASA-2026-0515 Updated curl package fixes security vulnerabilities

curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set...

Updated curl package fixes security vulnerabilities

curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set...

SUSE CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

SUSE CVE-2026-86411

An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...

SUSE CVE-2026-86412

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...

SUSE CVE-2026-86413

When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...