curl: curl allows SSH connection even if host is not in known_hosts

Summary: Curl does not fail if the SSH host identity cannot be verified due to the host not being included in the .ssh/knownhosts file. This makes using curl to login into an previously unknown ssh host system vulnerable to meddler in the middle attacks. When using key based authentication it wil...

Advisory ROSA-SA-2025-2569

software: curl 8.7.1 OS: ROSA-CHROME packageevrstring: curl-8.7.1-2 CVE-ID: CVE-2024-9681 BDU-ID: 2024-09106 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability exists in the implementation of the HSTS HTTP Strict Transport Security mechanism of the curl command line utility due to a bug in the...

Advisory ROSA-SA-2025-2567

software: curl 8.7.1 OS: ROSA-CHROME packageevrstring: curl-8.7.1-1 CVE-ID: CVE-2024-0853 BDU-ID: 2024-01014 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the TLS protocol implementation of the cURL command line utility is related to erroneous storage of the session ID as a result of a lack of...

K000149485: cURL vulnerability CVE-2024-11053

Security Advisory Description When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches th...

Security Bulletin: Vulnerabilities in Snappy, OpenSSL and cURL libcurl might affect IBM Storage Copy Data Management.

Summary IBM Storage Copy Data Management can be affected by vulnerabilities in Snappy, OpenSSL and cURL libcurl. An attacker, a local attacker or a remote attacker could exploit these vulnerabilities to cause JVM to crash, to cause a crash or memory contents to be sent to the peer, to bypass...

curl: Authorization Header Leak via --location-trusted in Curl

Curl's --location-trusted Option Leaks Authorization Header Across Domains The --location-trusted option in Curl forwards the Authorization header when following cross-origin redirects, exposing Basic Authentication credentials to untrusted hosts. - If an attacker controls a redirecting endpoint,...

OESA-2025-1021 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability has been found in cURL Network Utility Software and classified as problematic. Affected by this vulnerability is an unknown cod...

OESA-2025-1025 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability has been found in cURL Network Utility Software and classified as problematic. Affected by this vulnerability is an unknown cod...

OESA-2025-1023 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability has been found in cURL Network Utility Software and classified as problematic. Affected by this vulnerability is an unknown cod...

OESA-2025-1022 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability has been found in cURL Network Utility Software and classified as problematic. Affected by this vulnerability is an unknown cod...

[SECURITY] Fedora 41 Update: curl-8.9.1-3.fc41

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Medium: curl

Issue Overview: When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform...

Fedora 41 : curl (2024-a94430d221)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-a94430d221 advisory. - fix HSTS subdomain overwrites parent cache entry CVE-2024-9681 Tenable has extracted the preceding description block directly from the Fedora security...

Medium: curl

Issue Overview: When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform...

Amazon Linux 2 : curl (ALAS-2025-2724)

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2724 advisory. When curl is asked to use HSTS, the expiry time for a subdomain mightoverwrite a parent domain's cache entry, making it end sooner or...

Fedora 41 : php-tcpdf (2024-7d6412477b)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-7d6412477b advisory. Version 6.8.0 2024-12-23 - Requires PHP 7.1+ and curl extension. - Escape error message. - Use strict time-constant function to compare TCPDF-tag...

PT-2026-1660

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A key passphrase bypass is present in libssh when an agent is not set. This issue was discovered through analysis using curl. The potential impact is currently unknown. The vulnerability affects...

PT-2025-47036

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.17.0 Description The software is susceptible to a path traversal issue when handling URLs with percent-encoded slashes. This could allow an attacker to access files outside the intended directory. Recommendations Updat...

PT-2025-37027

Name of the Vulnerable Software and Affected Versions: curl affected versions not specified Description: The websocket code in curl did not update the 32-bit mask pattern for each new outgoing frame, as required by the specification. Instead, a fixed mask was used throughout the entire connection...

PT-2026-1657

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A bearer token leak occurs on a cross-protocol redirect. The issue involves curl and potentially allows unauthorized access due to the leakage of sensitive authentication tokens. Recommendations...