12804 matches found
Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-3267)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3267 advisory. During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object. CVE-2026-92392 Tenable h...
curl:curl_fuzzer_proto_smtp: Heap-use-after-free in Curl_client_cleanup
Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=4561124654383104 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerprotosmtp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x7bd59f9e43b...
CLSA-2026-1792808992 curl: Fix of CVE-2026-6276
CVE-2026-6276: clear the custom Host cookie host per request so cookies are not sent to another origin on connection reuse...
Important: curl
Issue Overview: During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object. CVE-2026-92392 Affected Packages: curl Issue Correction: Run dnf update curl --releasever 2023.12.202610...
Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images
Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2026-104851 DESCRIPTION: fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem...
Curl 7.69.1 < 8.23.0 SSH Known Hosts Validation Error
The version of curl installed on the remote host is 7.69.1 prior to 8.23.0. It is, therefore, affected by a host key validation vulnerability: - When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing...
Curl 7.21.0 < 8.23.0 FTP Wildcard Use-After-Free
The version of curl installed on the remote host is 7.21.0 prior to 8.23.0. It is, therefore, affected by a use-after-free vulnerability: - When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal...
Curl 8.10.0 < 8.23.0 Transfer Timeout Bypass DoS
The version of curl installed on the remote host is 8.10.0 prior to 8.23.0. It is, therefore, affected by a denial of service vulnerability: - By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its...
ROS-20261023-73-0016
The vulnerability in curl is related to insufficient restrictions on the communication channel for specified endpoints. Exploiting this vulnerability can allow a remote attacker to cause service failures...
Curl 7.81.0 < 8.23.0 SFTP/SCP Host Verification Bypass
The version of curl installed on the remote host is 7.81.0 prior to 8.23.0. It is, therefore, affected by a security bypass vulnerability: - A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a resul...
Curl 7.10.8 < 8.23.0 HTTP Proxy Credential Leak
The version of curl installed on the remote host is 7.10.8 prior to 8.23.0. It is, therefore, affected by an information disclosure vulnerability: - An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answeri...
Curl 8.7.0 < 8.23.0 Cookie Jar Parsing Issue
The version of curl installed on the remote host is 8.7.0 prior to 8.23.0. It is, therefore, affected by a cookie jar vulnerability: - When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit...
Curl 8.12.0 < 8.23.0 HTTP/2 Upload Use-After-Free
The version of curl installed on the remote host is 8.12.0 prior to 8.23.0. It is, therefore, affected by a use-after-free vulnerability: - During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a stru...
Curl 7.75.0 < 8.22.0 SigV4 Header Leak
The version of curl installed on the remote host is 7.75.0 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the...
Curl 7.20.0 < 8.23.0 Local File Overwrite
The version of curl installed on the remote host is 7.20.0 prior to 8.23.0. It is, therefore, affected by a file overwrite vulnerability: - When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response...
Curl 8.18.0 < 8.23.0 Cookie Jar Erasure
The version of curl installed on the remote host is 8.18.0 prior to 8.23.0. It is, therefore, affected by a data loss vulnerability: - A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for...
Curl 8.21.0 < 8.23.0 Multiple Connection Reuse Vulnerabilities
The version of curl installed on the remote host is 8.21.0 prior to 8.23.0. It is, therefore, affected by multiple connection reuse vulnerabilities: - libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel...
Curl 7.30.0 < 8.22.0 IMAP Command Injection
The version of curl installed on the remote host is 7.30.0 prior to 8.22.0. It is, therefore, affected by a command injection vulnerability: - Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The serv...
Curl 7.15.0 < 8.23.0 TFTP Data Disclosure
The version of curl installed on the remote host is 7.15.0 prior to 8.23.0. It is, therefore, affected by an information disclosure vulnerability: - libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for bo...
Curl 7.86.0 < 8.23.0 WebSocket GnuTLS Information Leak
The version of curl installed on the remote host is 7.86.0 prior to 8.23.0. It is, therefore, affected by an information disclosure vulnerability: - When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read...