758 matches found
CVE-2026-8932
🚨 CVE-2026-8932 - The Oldest libcurl Security Bug Incomplete mTLS Configuration Matching in libcurl The oldest security vulnerability ever fixed in libcurl—remaining unnoticed for over 25 years. 📖 Overview CVE-2026-8932 is a security vulnerability in libcurl where the library may incorrectly reus...
CVE-2026-8932-PoC
CVE-2026-8932 PoC Proof-of-concept reproduction of CVE-2026-8932 , an incomplete mTLS configuration matching issue in libcurl connection reuse. Overview CVE-2026-8932 affects libcurl's connection reuse logic when mutual TLS mTLS configuration changes between requests. Under vulnerable conditions,...
curl: SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections
The core effect is a silent host-authentication bypass: a transfer whose configured SSH host-key policy would reject the server is served anyway, with exit code 0 and no warning, because it reuses a pooled connection established under a weaker or absent policy. curl may assess this lower because ...
CVE-2026-3805-curl-SMB-UAF
CVE-2026-3805: Use-After-Free in curl SMB Connection Reuse I found a use-after-free vulnerability in libcurl's SMB protocol handler. When a second SMB transfer reuses an existing connection to the same server, the file path for the new request req-path is a dangling pointer to freed heap memory...
curl: SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connection
Summary For SCP/SFTP, curl verifies the server's host key once, during the initial connect state machine, in sshcheckfingerprint — which reads CURLOPTSSHHOSTPUBLICKEYSHA256 / MD5, the CURLOPTSSHKNOWNHOSTS file, and the CURLOPTSSHHOSTKEYFUNCTION callback. That function has exactly one caller,...
curl: CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth
Summary When libcurl tunnels through an HTTP proxy with CONNECT HTTPS-over-proxy, the custom headers set via CURLOPTPROXYHEADER are sent to the proxy once, at tunnel-setup time lib/httpproxy.c:63-83. The connection-reuse decision for a proxied connection, however, does not take proxyheaders into...
CVE-2026-87861
A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests...
CVE-2026-107929
When "CURLOPTINTERFACE" or the command line tool's "--interface" option is set with one of the documented prefixes "if!", "host!", "ifhost!", that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go ou...
curl: curl: cross-origin reuse of a Negotiate connection
A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests...
CURL-CVE-2026-86415 auto client cert connection reuse mixup
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...
CURL-CVE-2026-86411 FTP connection reuse inherits client-certificate
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
local interface connection reuse mixup
When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...
auto client cert connection reuse mixup
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...
CURL-CVE-2026-107929 local interface connection reuse mixup
When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...
UBUNTU-CVE-2026-107929
When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...
CVE-2026-107929
When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...
PT-2026-114001
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An issue exists where the connection reuse key does not include the binding when CURLOPT INTERFACE or the --interface command line option is configured with prefixes such as if!, host!, or...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : curl vulnerability (USN-8651-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8651-1 advisory. It was discovered that curl incorrectly handled reusing connections when the origin change...
Ubuntu 24.04 LTS : curl vulnerability (USN-8670-1)
The remote Ubuntu 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8670-1 advisory. Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client...
curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse
A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTPS request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connectio...