12833 matches found
Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...
ROS-20260921-73-0019
The vulnerability in curl relates to the provision of data elements for an erroneous session. Exploiting this vulnerability can allow a perpetrator to enhance their privileges...
ALSA-2026:69126 Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...
curl security update
7.76.1-40.el98.7 - add sasl service name to connection reuse checks CVE-2026-8458 7.76.1-40.el98.6 - detect proxy changes read from environment CVE-2026-8927...
ALSA-2026:69125 Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: curl: Information...
EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-3830)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even...
Critical Photon OS Security Update - PHSA-2026-5.0-91-1008
Updates of 'curl', 'linux-esx', 'linux' packages of Photon OS have been released...
CLSA-2026-1789899988 curl: Fix of 3 CVEs
CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...
CLSA-2026-1789899690 curl: Fix of 3 CVEs
CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...
CLSA-2026-1789899321 curl: Fix of 3 CVEs
CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...
curl: CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL
A .netrc-sourced password, injected into the live URL handle at login time, survives an ordinary same-host relative Location: redirect and ends up verbatim in data-state.url, so it is exposed via CURLINFOEFFECTIVEURL, curl -w '%urleffective', and verbose -v output. Affected code...
curl: Windows filename sanitizer misses Unicode COM/LPT reserved device names
Hi all, I found a way for a server-selected Windows filename to bypass curl's reserved DOS device-name sanitizer. With curl -O -J, a Content-Disposition filename such as COM¹, COM², COM³, LPT¹, LPT², or LPT³ is left unchanged, even though Windows treats all six as reserved device names. Curl...
curl: CVE-2026-94265: Authorization: Negotiate sent to foreign origin
Hi all, I've discovered that curl can be made to send an "Authorization: Negotiate" header, carrying a freshly minted Kerberos ticket for the victim's ambient identity, to a host chosen by an HTTP redirect, without --location-trusted. All the attacker has to do is put arbitrary userinfo in the...
CLEANSTART-2026-CR32311 Security fix for CVE-2026-24515 applied in: apache-zookeeper 3.7.2-r4, cloudnative-pg-fips 1.24.4-r1, cloudnative-pg-fips 1.25.4-r1, curl 8.16.0-r0, curl 8.17.0-r0, curl 8.18.0-r0, druid-exporter-fips 0.10-r2, druid-exporter-fips 0.11-r3, druid-exporter-fips 0.8-r1, druid-exporter-fips 0.9-r1, expat 2.7.2-r0, minio-operator-fips 5.0.18-r6, opentofu-fips 1.7.10-r1, opentofu-fips 1.8.11-r1, tomcat11 11.0.18-r0
CVE-2026-24515 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-CU80287 Security fix for CVE-2014-0139 applied in: curl 7.36.0-r0
Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-JW10713 Security fix for CVE-2014-0138 applied in: curl 7.36.0-r0
Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-JM41545 Security fix for CVE-2016-5421 applied in: curl 7.50.1-r0
Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-UL86016 Security fix for CVE-2016-5420 applied in: curl 7.50.1-r0
Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-DO77426 Security fix for CVE-2016-5419 applied in: curl 7.50.1-r0
Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-RA92052 Security fix for CVE-2016-7141 applied in: curl 7.50.2-r0
Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...