CVE-2026-87861

A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests...

CVE-2026-92387

A flaw was found in curl. When communicating with a malicious server using protocols such as FTP, IMAP, POP3, or SMTP, the server can trigger an infinite loop by continuously transmitting data while omitting the final control response line. This behavior bypasses configured transfer timeouts,...

CVE-2026-92389

A flaw was found in curl. When handling Trivial File Transfer Protocol TFTP transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive...

CVE-2026-92390

A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 Early Hints response or through specific header ordering. This flaw allows...

CVE-2026-94265

A flaw was found in curl. When processing an HTTP redirect to an address containing user credentials, curl improperly retains and retransmits authentication state. A malicious server can exploit this behavior by redirecting curl to an untrusted destination, forcing the client to transmit sensitiv...

CVE-2026-94266

A flaw was found in curl. This vulnerability can lead to information disclosure by inadvertently revealing authentication credentials. When curl retrieves credentials from a local configuration file such as a .netrc file, requesting the effective URL metadata can cause the returned destination...

CVE-2026-92386

A flaw was found in curl. A remote malicious server can trigger a denial of service DoS in cookie handling by providing an overly long cookie name and value that exceeds curl's line-length limit when saved to a cookie file. Subsequent curl operations reading from this cookie file silently abort...

CVE-2026-92391

A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions MIME structures to an application utilizing the libcurl library. During memory cleanup in the curlmimefree function, excessive recursive calls exhaust available stack memory, leading to an...

CVE-2026-19931 affecting package curl for versions less than 8.11.1-12

CVE-2026-19931 affecting package curl for versions less than 8.11.1-12. A patched version of the package is available...

CVE-2026-18924 affecting package curl for versions less than 8.11.1-12

CVE-2026-18924 affecting package curl for versions less than 8.11.1-12. A patched version of the package is available...

CVE-2026-80230 affecting package curl for versions less than 8.11.1-12

CVE-2026-80230 affecting package curl for versions less than 8.11.1-12. A patched version of the package is available...

CVE-2026-13608 affecting package curl for versions less than 8.11.1-12

CVE-2026-13608 affecting package curl for versions less than 8.11.1-12. A patched version of the package is available...

curl:curl_fuzzer_proto_multi: Use-of-uninitialized-value in cf_socket_send

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5434019412770816 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerprotomulti Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

curl: OpenSSL provider OSSL_LIB_CTX used after free via the connection shutdown list (CVE-2026-80229 fix incomplete)

Summary: The CVE-2026-80229 fix 7ea37abc6a, 8.22.0 only marks provider connections connclose, but a closed TLS connection is handed to the multi handle's shutdown list lib/conncache.c:242 and outlives its easy handle, while curleasycleanup frees the handle's OSSLLIBCTX osslprovidercleanup,...

curl: CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples

Summary: The CVE-2026-7009 fix 51905671e0 made a missing staple fatal when Apple SecTrust verifies the chain, but when a staple is present curl still skips its own verifystatus lib/vtls/openssl.c:4864-4873, !octx-sectrustverified and leaves the staple to SecTrust. SecTrust evaluates it...

MiracleLinux 9 : curl-7.76.1-40.el9_8.8 (AXSA:2026-2080:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2080:08 advisory. curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure via incorrect Digest...

OPENSUSE-SU-2026:12150-1 curl-8.23.0-1.1 on GA media

These are all security issues fixed in the curl-8.23.0-1.1 package on the GA media of openSUSE Tumbleweed...

cURL Use-After-Free

The vulnerability of the software for interacting with servers via cURL is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Astra Linux – Vulnerability in curl

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname, but the...

Astra Linux – Vulnerability in curl

During an upload process, curl improperly handles HTTP/2 RSTSTREAM requests received from the server. This occurs when the reason for the refusal is HTTP11REQUIRED or REFUSEDSTREAM. As a result, a use-after-free condition arises for the struct Curleasy object...