CVE-2026-1965

libcurl suffers from a logical error that can cause it to wrongfully reuse an existing connection when performing Negotiate-authenticated HTTP or HTTPS requests. Because Negotiate sometimes authenticates connections rather than individual requests, a second request using different credentials (us...

CURL-CVE-2026-3805 use after free in SMB connection reuse

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory...

CURL-CVE-2026-3784 wrong proxy connection reuse with credentials

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection...

CURL-CVE-2026-3783 token leak with redirect and netrc

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with eithe...

bad reuse of HTTP Negotiate connection

libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of...

curl: NULL Pointer Dereference (DoS) in libcurl SFTP QUOTE command parsing due to missing return statement

Summary: A logic flaw in lib/vssh/libssh2.c causes a NULL pointer dereference when parsing SFTP QUOTE commands with trailing garbage. The function returnquoteerror is called to handle errors and free memory, but the return keyword is missing in several blocks e.g., lines 840, 857, 870. This allow...

Linux Distros Unpatched Vulnerability : CVE-2026-3783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second...

FreeBSD : curl -- Multiple vulnerabilities (086d53fa-1d47-11f1-81da-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 086d53fa-1d47-11f1-81da-8447094a420f advisory. The curl project reports: Multiple vulnerabilities Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-3805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. CVE-2026-3805 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-3784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The...

CVE-2026-3784: Authentication Bypass by Primary Weakness

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection...

curl security vulnerabilities

curl is an open-source tool developed by cURL for transferring data from or to a server. Curl has a security vulnerability that stems from a logical error leading to improper reuse of connections. This allows requests using different credentials to mistakenly reuse the same connection...

PT-2026-24664

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description curl improperly reuses an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different credentials for the HTTP proxy. The expected behavi...

curl security vulnerabilities

curl is an open-source tool developed by cURL for transferring data from or to a server. Curl has a security vulnerability that arises from the use of OAuth2 bearer tokens for HTTPS transfers. In some cases, this vulnerability may lead to the token being leaked to another hostname...

CVE-2026-3783: Insufficiently Protected Credentials

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with eithe...

FreeBSD : curl -- Multiple vulnerabilties (1933737d-1d46-11f1-81da-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1933737d-1d46-11f1-81da-8447094a420f advisory. The curl project reports: Tenable has extracted the preceding description block directly from...

curl security vulnerabilities

curl is an open-source tool developed by cURL for transferring data from or to a server. Curl has a security vulnerability that stems from the use of data pointers pointing to freed memory during repeated SMB requests, which may lead to memory corruption...

curl security vulnerabilities

curl is an open-source tool developed by cURL for transferring data from or to a server. Curl has a security vulnerability that stems from the incorrect reuse of existing HTTP proxy connections, which may lead to errors in processing new requests with different credentials...

CVE-2026-3805: Use After Free

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory...

curl: CURLOPT_UNRESTRICTED_AUTH Dangerous Default Documentation Gap

Summary: CURLOPTUNRESTRICTEDAUTH=1 instructs libcurl to send credentials to ALL hosts during redirect chains, 'possibly again and again as the following hosts can keep redirecting to new hosts.' The documentation explicitly warns this is dangerous, but the default behavior is also risky: curl onl...