12804 matches found
Curl 8.2.0 < 8.23.0 HSTS Cache Erasure
The version of curl installed on the remote host is 8.2.0 prior to 8.23.0. It is, therefore, affected by a data loss vulnerability: - An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme...
Curl 7.62.0 < 8.23.0 Effective URL Password Leak
The version of curl installed on the remote host is 7.62.0 prior to 8.23.0. It is, therefore, affected by an information disclosure vulnerability: - libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provid...
Curl 7.56.0 < 8.23.0 MIME Stack Overflow
The version of curl installed on the remote host is 7.56.0 prior to 8.23.0. It is, therefore, affected by a stack overflow vulnerability: - A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive...
Curl 8.11.0 < 8.23.0 HSTS Policy Loss
The version of curl installed on the remote host is 8.11.0 prior to 8.23.0. It is, therefore, affected by a policy handling vulnerability: - Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the...
Curl 8.9.0 < 8.23.0 Interface Connection Reuse Issue
The version of curl installed on the remote host is 8.9.0 prior to 8.23.0. It is, therefore, affected by a connection reuse vulnerability: - When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part...
curl: CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entry
Summary In required netrc mode CURLNETRCREQUIRED, as set by --netrc or --netrc-file, the CURLOPTNETRC documentation says any credential information present in the URL is ignored, but when the configured .netrc file loads successfully yet has no entry matching the requested host and username,...
curl: CVE-2026-115529: Schannel TLS auto client session resumption
Summary: In curl 8.23.0 with Schannel, TLS session resumption preserves an authenticated client certificate identity across a cross-origin redirect even after automatic client certificate selection is disabled. This appears to be an incomplete fix for CVE-2026-86415, where the original fix...
curl: --cert-status with OpenSSL accepts a stapled OCSP response of any age when it lacks nextUpdate (revoked certificate keeps passing)
Summary: curl built with OpenSSL accepts a stapled OCSP "good" response of any age under CURLOPTSSLVERIFYSTATUS --cert-status when the response omits nextUpdate, so a response signed before a certificate was revoked keeps passing the check for as long as the certificate itself is valid. The GnuTL...
RockyLinux 9 : curl (RLSA-2026:80511)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80511 advisory. curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure via incorrect Digest...
ALPINE-CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
AZL-109947 CVE-2026-94266 affecting package curl 8.11.1-11
libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
AZL-110247 CVE-2026-92390 affecting package rust 1.96.1-2
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
AZL-110310 CVE-2026-92390 affecting package tensorflow 2.16.1-11
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
AZL-109959 CVE-2026-92391 affecting package curl 8.11.1-11
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process...
AZL-109944 CVE-2026-92388 affecting package curl 8.11.1-11
When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash,...
AZL-109950 CVE-2026-92389 affecting package curl 8.11.1-11
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...
AZL-109974 CVE-2026-92387 affecting package curl 8.11.1-11
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...
DEBIAN-CVE-2026-92386
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...
ALPINE-CVE-2026-92386
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...