PT-2026-114422

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description When built with wolfSSL, curl may incorrectly validate a pinned public key hash against a key that the TLS peer does not possess. This occurs during the TLS handshake when wolfSSL validates the...

CVE-2026-92392: Use After Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

PT-2026-114313

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An issue exists during the HSTS cache import process where importing a parent HSTS entry with the includeSubDomains flag before a longer-lived child entry causes the child entry to be silently...

CVE-2026-92392: Use After Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

PT-2026-114425

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description When processing an HTTP redirect to a URL containing userinfo a username:password component, curl may incorrectly retain and re-transmit the HTTP Negotiate authentication state from the original...

RockyLinux 10 : curl (RLSA-2026:80512)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80512 advisory. curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies CVE-2026-6253 curl: libcurl: Authentication bypass due to incorrect HT...

Rocky Linux 9 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (crlsa-2026_80511)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680511 advisory. curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure via incorrect Digest...

PT-2026-114315

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description Enabling CURLOPT CRLF allows for command injection during IMAP APPEND operations. When transmitting line-ending expanded data, curl advertises the raw input byte count in the IMAP APPEND N...

PT-2026-114420

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description An ftp:// transfer configured with CURLUSESSL NONE may reuse a pooled FTP control connection previously upgraded with STARTTLS and authenticated via a client certificate. Because the subsequent...

PT-2026-113731

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description When built with GnuTLS, a malicious WebSocket server can cause curl to send memory beyond its send buffer. This occurs because of an out-of-bounds read that happens when the gnutls record send...

Linux Distros Unpatched Vulnerability : CVE-2026-92386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit...

Linux Distros Unpatched Vulnerability : CVE-2026-86415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be...

Linux Distros Unpatched Vulnerability : CVE-2026-94266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcur...

Linux Distros Unpatched Vulnerability : CVE-2026-92388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal...

Linux Distros Unpatched Vulnerability : CVE-2026-92387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured...

Linux Distros Unpatched Vulnerability : CVE-2026-87863

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extrem...

Linux Distros Unpatched Vulnerability : CVE-2026-94265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's...

Linux Distros Unpatched Vulnerability : CVE-2026-86410

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of...

Linux Distros Unpatched Vulnerability : CVE-2026-92390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes...

Linux Distros Unpatched Vulnerability : CVE-2026-86409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle...