CURL-CVE-2026-8932 incomplete mTLS config matching in conn reuse

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS...

CURL-CVE-2026-9080 UAF after pause in socket callback

Calling curleasypause within the event-based CURLMOPTSOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed...

ROS-20260624-73-0040

The vulnerability in curl is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a remote attacker to execute a SSRF attack...

Linux Distros Unpatched Vulnerability : CVE-2026-9547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted...

Linux Distros Unpatched Vulnerability : CVE-2026-9079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for...

Linux Distros Unpatched Vulnerability : CVE-2026-50019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked t...

Linux Distros Unpatched Vulnerability : CVE-2026-8932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps...

Linux Distros Unpatched Vulnerability : CVE-2026-11586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious...

PT-2026-51753

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description A use-after-free issue occurs when the curl easy pause function is called within the event-based CURLMOPT SOCKETFUNCTION callback. This leads to a situation where libcurl attempts to store a...

ROS-20260624-73-0034

The vulnerability in curl is related to the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

ROS-20260624-73-0037

The vulnerability in curl is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

ROS-20260624-73-0038

The vulnerability in curl is related to insufficient protection of registration data. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-11564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first use...

PT-2026-51748

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description The logic handling SASL Simple Authentication and Security Layer authentication may clean up the GSASL context twice without clearing the pointer in between. This results in a double-free...

ROS-20260624-73-0039

The vulnerability in curl is related to incorrect session duration settings. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

ROS-20260624-73-0035

The vulnerability in curl is related to errors in the certificate validation process. Exploitation of this vulnerability can be carried out remotely...

PT-2026-51747

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A flaw in the cookie parsing logic allows a malicious HTTP server to set super cookies that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that...

Linux Distros Unpatched Vulnerability : CVE-2026-9545

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced...

Linux Distros Unpatched Vulnerability : CVE-2026-9080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Calling curleasypause within the event-based CURLMOPTSOCKETFUNCTION callback triggers a use- after-free vulnerability, where libcurl attempts to store a flag...

[R3] Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities

R3 Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities Aaron Roy Tue, 06/23/2026 - 16:43 Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components .NET Windows Server Hosting, NodeJS, Erlang OTP, SQ...