34557 matches found
AZL-99837 CVE-2026-80229 affecting package rust 1.75.0-31
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...
CVE-2026-19931
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...
ALPINE-CVE-2026-19931
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...
AZL-99777 CVE-2026-19931 affecting package cmake 3.30.3-15
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...
AZL-99870 CVE-2026-19931 affecting package tensorflow 2.16.1-11
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...
AZL-99819 CVE-2026-19931 affecting package rust 1.75.0-30
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...
AZL-99792 CVE-2026-19931 affecting package mysql 8.0.46-1
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...
AZL-99843 CVE-2026-19931 affecting package rust 1.90.0-10
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...
AZL-99879 CVE-2026-18924 affecting package tensorflow 2.16.1-11
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...
AZL-99752 CVE-2026-19931 affecting package curl 8.11.1-11
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...
EUVD-2026-72169
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
CVE-2026-80231
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
CVE-2026-80231 native CA store conn reuse
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
CVE-2026-80231 native CA store conn reuse
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
CVE-2026-80231
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting "CURLSSLOPTNATIVECA" than when the connection was created...
CVE-2026-80231 native CA store conn reuse
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
CVE-2026-80231
A vulnerability in libcurl allows the library to incorrectly reuse an existing HTTPS connection for a given hostname when there is a mismatch in the Native CA Store setting (CURLSSLOPT_NATIVE_CA) compared to the initial connection. Additionally, research indicates a related issue where a TLS sess...
CVE-2026-80231
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...
EUVD-2026-72168
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...
CVE-2026-80230 OpenSSL pinning bypass
When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...