cve-2021-42013

CVE-2021-42013 C implementation of the infamous Apache 2.4.50 exploit Compiling $ gcc cve-2021-42013.c -lcurl -o cve-2021-42013 Using $ ./cve-2021-42013 Example...

libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse

A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security mTLS settings, particularly those for client certificates, should have prevented such reuse...

curl: curl: Information disclosure via incorrect Digest authentication header reuse

A flaw was found in curl. When libcurl performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials

A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting i...

curl: libcurl: Unauthorized connection reuse due to a logical error

A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different...

Multiple vulnerabilities impacts AIX due to cURL libcurl

IBM SECURITY ADVISORY First Issued: Mon Sep 21 04:38:42 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/curladvisory12.asc Security Bulletin: Multiple vulnerabilities impacts AIX due to cURL libcurl...

Exploit for Authentication Bypass by Primary Weakness in Haxx Curl

CVE-2026-8932 PoC Proof-of-concept reproduction of CVE-2026...

EulerOS Virtualization 2.10.0 : cifs-utils (EulerOS-SA-2026-3864)

According to the versions of the cifs-utils packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connectio...

external_curl_AOSP10_r33_CVE-2021-22924

root@kitploit: | | | | | | / | | | | | | | | | || | | | |/|| \| README Curl is a command line tool for transferring data specified with URL syntax. Find out how to use curl by reading the curl.1 man page or the MANUAL document. Find out how to install Curl by reading the INSTALL document...

CVE-2023-44487

Ten en cuenta que el código anterior usa la biblioteca libcurl para realizar solicitudes HTTP. Necesitas instalar libcurl y enlazarlo al compilar el código. El código es una versión simplificada, y es posible que debas ajustarlo según tus requisitos exactos y el comportamiento específico del ataq...

CVE-2026-82209

A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a Set-Cookie header with a Domain attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope,...

CVE-2026-18924

A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service. Mitigation Disable HTTP/2 Server Pu...

CVE-2026-19931

A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection...

Astra Linux – Vulnerability in curl

There is an authentication bypass vulnerability in libcurl version 8.0.0, particularly in the FTP connection reuse feature. This vulnerability can cause incorrect credentials to be used during subsequent transfers. Previously created connections are retained in a connection pool for reuse if they...

Astra Linux – Vulnerability in curl

Due to the use of a dangling pointer, libcurl versions 7.29.0 through 7.71.1 can use the wrong connection when sending data...

Astra Linux – Vulnerability in curl

libcurl will reuse a previously established connection even when options related to TLS or SSH have been changed, which should prevent such reuses. libcurl stores previously used connections in a connection pool, allowing for reuse if one of them matches the current setup. However, several TLS an...

Astra Linux – Vulnerability in curl

A authentication bypass vulnerability exists in libcurl prior to v8.0.0. It reuses an previously established SSH connection, even though one SSH option has been modified, which should prevent such reuse. libcurl maintains a pool of previously used connections and can reuse them for subsequent...

Astra Linux – Vulnerability in curl

When performing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl may still mistakenly accept connections to hosts that are not present in the specified file, if those hosts are added as recognized in the libssh global knownhosts file...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2026-106769)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106769 advisory. libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps...