Linux Distros Unpatched Vulnerability : CVE-2026-86409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle...

Linux Distros Unpatched Vulnerability : CVE-2026-87864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server rea...

Linux Distros Unpatched Vulnerability : CVE-2026-87865

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to t...

Linux Distros Unpatched Vulnerability : CVE-2026-86413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an...

Linux Distros Unpatched Vulnerability : CVE-2026-107928

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when...

Linux Distros Unpatched Vulnerability : CVE-2026-87861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a...

Linux Distros Unpatched Vulnerability : CVE-2026-86412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for...

Linux Distros Unpatched Vulnerability : CVE-2026-92389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and...

Linux Distros Unpatched Vulnerability : CVE-2026-86414

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNE...

Linux Distros Unpatched Vulnerability : CVE-2026-107929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of...

Linux Distros Unpatched Vulnerability : CVE-2026-92391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive...

Linux Distros Unpatched Vulnerability : CVE-2026-87866

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL...

Linux Distros Unpatched Vulnerability : CVE-2026-92392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct...

Linux Distros Unpatched Vulnerability : CVE-2026-87862

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's...

Fedora 44 : curl (2026-a06b828d65)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a06b828d65 advisory. - Fix incomplete mTLS config matching in conn reuse CVE-2026-8932 - Fix OpenLDAP SASL authentication bypass CVE-2026-13608 - Fix OpenSSL pinning...

FreeBSD : Curl -- Multiple vulnerabilities (14dab969-c797-11f1-a6ea-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 14dab969-c797-11f1-a6ea-8447094a420f advisory. The Curl project reports: Tenable has extracted the preceding description block directly from...

Debian dsa-6558 : curl - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6558 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6558-1 [email protected] https://www.debian.org/securit...

CVE-2026-110102

The Powerlevel10k shell theme (versions through 1.20.0 ) contains an insecure download vulnerability within the gitstatus/install script. The flaw is caused by the script using curl -k to disable TLS certificate verification and omitting integrity checks when a SHA-256 utility is unavailable. A n...

curl resource management error vulnerability

There is a vulnerability in curl’s resource management. This vulnerability arises from incorrect handling of HTTP/2 RSTSTREAM responses by curl during the upload process. The reason for this is that HTTP11REQUIRED or REFUSEDSTREAM conditions were encountered, leading to the reutilization of the...

RLSA-2026:80511 Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure...