OS Command Injection

Nuclio is vulnerable to OS Command Injection. The vulnerability is due to improper sanitization of event.headers keys and event.body values when constructing curl commands for Kubernetes CronJob containers, which allows an attacker to inject and execute arbitrary shell commands by manipulating...

ROOT-OS-DEBIAN-13-CVE-2026-6253 CVE-2026-6253 in rootio-curl - Patched by Root

Root has patched CVE-2026-6253 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-7168 CVE-2026-7168 in rootio-curl - Patched by Root

Root has patched CVE-2026-7168 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-4873 CVE-2026-4873 in rootio-curl - Patched by Root

Root has patched CVE-2026-4873 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-14524 CVE-2025-14524 in rootio-curl - Patched by Root

Root has patched CVE-2025-14524 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-3783 CVE-2026-3783 in rootio-curl - Patched by Root

Root has patched CVE-2026-3783 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-1965 CVE-2026-1965 in rootio-curl - Patched by Root

Root has patched CVE-2026-1965 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-6429 CVE-2026-6429 in rootio-curl - Patched by Root

Root has patched CVE-2026-6429 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-3805 CVE-2026-3805 in rootio-curl - Patched by Root

Root has patched CVE-2026-3805 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-6276 CVE-2026-6276 in rootio-curl - Patched by Root

Root has patched CVE-2026-6276 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-14819 CVE-2025-14819 in rootio-curl - Patched by Root

Root has patched CVE-2025-14819 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-3784 CVE-2026-3784 in rootio-curl - Patched by Root

Root has patched CVE-2026-3784 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-5773 CVE-2026-5773 in rootio-curl - Patched by Root

Root has patched CVE-2026-5773 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-5545 CVE-2026-5545 in rootio-curl - Patched by Root

Root has patched CVE-2026-5545 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

SUSE CVE-2026-8924

A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains...

SUSE CVE-2026-8925

The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free the same pointer twice...

SUSE CVE-2026-9080

Calling curleasypause within the event-based CURLMOPTSOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed...

SUSE CVE-2026-11352

An issue in curl's QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can...

SUSE CVE-2026-11586

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages...

SUSE CVE-2026-11856

Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a different one hostB for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB...