12378 matches found
SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:3798-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3798-1 advisory. - CVE-2026-5545: wrong reuse of HTTP Negotiate connection bsc1262632. - CVE-2026-5773: wrong reuse of SMB...
TencentOS Server 3: curl (TSSA-2026:0910)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0910 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
curl: CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection
Summary When CURLOPTCRLF is enabled, imapperformappend advertises the original input file size in the IMAP APPEND ... N literal but then transmits the expanded body bare LF → CRLF. The server consumes exactly N bytes as the literal, and the overflow bytes are parsed as new IMAP commands in the sa...
curl: CVE-2026-80255: secure cookie attribute bypass with tab
Summary A Set-Cookie header using HTAB horizontal tab instead of SPACE before the Secure attribute — e.g. Set-Cookie: sid=SECRET;\tSecure — causes curl to store the cookie without its Secure flag. The cookie is then sent over plaintext HTTP on subsequent requests to the same host. The...
curl: CVE-2026-82209: domain-scoped PSL domain cookie
Summary When libpsl is enabled and a response host is itself a public suffix e.g. github.io, a Set-Cookie header whose Domain attribute exactly equals that host is accepted by psliscookiedomainacceptable but stored with tailmatch = TRUE. RFC 6265 §5.3 requires this exact-match case to produce a...
curl: CVE-2026-87863: HSTS response erases persisted entries
Summary An authenticated HTTPS origin can return a Strict-Transport-Security: max-age value that Curlhstsparse accepts but curlxgmtime cannot later serialize. On 64-bit platforms, max-age=67768036190000000 produces an absolute expiry within timet range but outside struct tm's representable range...
curl: CVE-2026-87862: HSTS cache import drops longer-lived child
HSTS cache import silently drops a longer-lived child beneath an includeSubDomains parent Summary Loading an HSTS cache file or CURLOPTHSTSREADFUNCTION callback can silently discard a child entry. When a live includeSubDomains parent is imported before a longer-lived includeSubDomains child, only...
curl: 12: SASL DIGEST-MD5 does not validate the server's `rspauth` proof
Summary curl never verifies the rspauth value the server sends during SASL DIGEST-MD5 authentication. In Curlsaslcontinue lib/curlsasl.c, the SASLDIGESTMD5RESP handler unconditionally sends an empty acknowledgment without reading or checking the server's continuation data. Authentication then...
curl: 10: CURLOPT_MAXLIFETIME_CONN bypass on active HTTP/2 connections
Summary CURLOPTMAXLIFETIMECONN is not enforced when a new transfer is attached to an active multiplexed HTTP/2 connection. The connection-age eligibility check in urlmatchconn is gated behind !CONNINUSEconn, so an in-use HTTP/2 connection with spare stream capacity is accepted without any age...
curl: 46: `--libcurl` output carries `--insecure` across `--next` boundaries
Summary When --libcurl generates C source for a command that uses --next to separate multiple operations, local options from earlier operations leak into later ones. Specifically, if the first operation uses --insecure and the second does not, the generated program silently skips TLS certificate...
curl: 43: HTTP proxy CONNECT header chooses the `-OJ` filename after a redirect
Summary When curl follows an HTTPS redirect through an HTTP CONNECT proxy, a stale response code lets the proxy's CONNECT response Content-Disposition header control the local output filename. With --location --remote-name --remote-header-name, the proxy-provided filename is used for the...
curl: CVE-2026-87861: cross-origin reuse of a Negotiate connection
Summary: I found a cross-origin connection reuse flaw in lib/url.c, introduced by bd10924b4 as part of the recently announced "Patch the Planet" initiative. It causes a request for one origin to be sent on a connection that was authenticated with Negotiate for a different origin, while the...
curl: 36: HTTP upload resume offset consumed twice after early 307/308 redirect
Summary A read-backed HTTP POST using CURLOPTRESUMEFROMLARGE with a non-seekable source silently uploads the wrong data when the server returns a 307 or 308 redirect before the request body is sent. curleasyperform returns CURLEOK, so the caller cannot detect the substitution. The bug is in...
curl: 33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)
Summary After a completed CURLOPTCONNECTONLY transfer, detaching the shared connection pool via curleasysetopteasy, CURLOPTSHARE, NULL causes curleasysend / curleasyrecv to silently operate on an unrelated connection from a different pool. Data intended for server B is sent to server A, and A's...
curl: 27: IMAP custom FETCH listing classification skips literal boundaries, enabling response desynchronization
Summary iscustomfetchlistingmatch in lib/imap.c classifies any custom FETCH whose sequence set contains : or , as a "listing." For that classification, imapstatelistsearchresp skips literal detection entirely. The ping-pong line parser then scans the server-declared literal body as IMAP protocol...
curl: 29: CURLOPT_ISSUERCERT accepts a different-key certificate when issuer metadata collides
Summary osslcheckissuer in lib/vtls/openssl.c uses X509checkissued to implement CURLOPTISSUERCERT. This OpenSSL function checks metadata subject/issuer names, key identifiers, algorithm compatibility, key usage but does not verify the certificate's cryptographic signature. A certificate with...
SUSE-SU-2026:23361-1 Security update for curl
This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. Changes for curl: - Call httpsize first to prioritize...
SUSE-SU-2026:23350-1 Security update for curl
This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. Changes for curl: - Call httpsize first to prioritize...
curl: 28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket
Summary When CURLOPTSOCKOPTFUNCTION returns CURLSOCKOPTALREADYCONNECTED, the HTTP/3 QUIC UDP code path ignores it and calls connect anyway, silently reassociating the application-provided socket to a different peer. The TCP path has the correct check. This violates the documented callback contrac...
curl: Heap-use-after-free in CURLOPT_REFERER when passed a CURLINFO_REFERER pointer
Summary Setting CURLOPTREFERER with a pointer previously obtained from CURLINFOREFERER on the same easy handle triggers a heap-use-after-free. The CURLOPTREFERER handler frees data-state.referer line lib/setopt.c:2089 before Curlsetstropt reads from the now-dangling pointer line...