UBUNTU-CVE-2026-107928

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutlsrecordsend returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked...

UBUNTU-CVE-2026-92390

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

UBUNTU-CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

UBUNTU-CVE-2026-86412

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...

CVE-2026-86410

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

CVE-2026-86412

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...

CVE-2026-92386

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

[SECURITY] Fedora 44 Update: curl-8.18.0-14.fc44

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Multiple vulnerabilities impacts AIX due to cURL libcurl

IBM SECURITY ADVISORY First Issued: Wed Oct 14 00:51:44 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/curladvisory13.asc Security Bulletin: Multiple vulnerabilities impacts AIX due to cURL libcurl...

PT-2026-113740

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A remote HTTP server can set a cookie that is accepted and written to a Netscape cookie jar but cannot be reloaded. When curl is subsequently invoked using the same path for the --cookie and...

PT-2026-114347

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A deeply nested multipart MIME structure created through the public API causes a stack overflow in libcurl during cleanup. This occurs because the curl mime free function uses excessive recursio...

Fedora 44 : curl (2026-a06b828d65)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a06b828d65 advisory. - Fix incomplete mTLS config matching in conn reuse CVE-2026-8932 - Fix OpenLDAP SASL authentication bypass CVE-2026-13608 - Fix OpenSSL pinning...

PT-2026-113741

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description When using an ambient user during an initial transfer with Negotiate authentication, curl may incorrectly transmit credential details to an unrelated second origin if it is instructed to follow...

PT-2026-113738

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description Setting CURLOPT AWS SIGV4 to NULL fails to disable SigV4 authentication as expected and documented. Consequently, a subsequent transfer using the same handle continues to send the Authorization:...

PT-2026-113739

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description A logic flaw in the curl command line tool prevents SSH host verification options from being applied when a connection is established via a redirect. Specifically, if the initial request is HTTPS a...

PT-2026-113742

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An HTTP proxy can trick libcurl into sending the origin's credentials, such as Basic passwords or Negotiate/Kerberos tickets, directly to the proxy. This occurs when the proxy responds to a...

PT-2026-113749

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl by permanently omitting the final control-response line. This action allows the server to completely bypass the configured transfe...

PT-2026-114001

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An issue exists where the connection reuse key does not include the binding when CURLOPT INTERFACE or the --interface command line option is configured with prefixes such as if!, host!, or...

PT-2026-114314

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An authenticated HTTPS origin can provide an HSTS max-age value that is accepted by the parser but fails during subsequent time serialization. On 64-bit systems, extreme max-age values can resul...

PT-2026-114424

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description When using the --remote-header-name -J option, the software fails to maintain anti-clobbering protection under specific conditions. This occurs if an intermediate 103 Early Hints response precedes...