767 matches found
CVE-2026-107929
When "CURLOPTINTERFACE" or the command line tool's "--interface" option is set with one of the documented prefixes "if!", "host!", "ifhost!", that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go ou...
CVE-2026-107929
When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...
CVE-2026-107929
A flaw in curl allows for a local interface connection reuse mixup when using connection pooling with forced local interface binding. Specifically, when CURLOPT_INTERFACE (or the --interface command-line option) is set with prefixes like if!, host!, or ifhost!, these bindings are excluded from th...
EUVD-2026-105359
When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...
CVE-2026-107929
When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...
CVE-2026-86415
A flaw in libcurl builds configured with the Microsoft Schannel TLS backend allows for an auto client cert connection reuse mixup . The connection cache match function fails to evaluate client certificate authentication settings during HTTP redirects. This enables a malicious server to redirect a...
CVE-2026-86415
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...
CVE-2026-86411
A flaw in curl allows unauthorized access due to improper session reuse. When an unencrypted FTP transfer reuses a pooled control connection that was previously authenticated with a client certificate and upgraded via STARTTLS , curl fails to perform a new TLS handshake or authentication. Consequ...
CVE-2026-8932
🚨 CVE-2026-8932 - The Oldest libcurl Security Bug Incomplete mTLS Configuration Matching in libcurl The oldest security vulnerability ever fixed in libcurl—remaining unnoticed for over 25 years. 📖 Overview CVE-2026-8932 is a security vulnerability in libcurl where the library may incorrectly reus...
curl: curl reuses an HTTPS connection when a response is already buffered in the TLS stack
curl master 15292ed75, 8.23.1-DEV reuses an idle HTTP/1.1-over-TLS connection even when a complete extra response is already buffered in OpenSSL/GnuTLS. The ef6b17cf1 fix only polls the socket: Curlcpoolconnseemshealthy lib/conncache.c:1073, called from lib/url.c:1071 uses Curlconnisalive, and...
CVE-2026-8932-PoC
CVE-2026-8932 PoC Proof-of-concept reproduction of CVE-2026-8932 , an incomplete mTLS configuration matching issue in libcurl connection reuse. Overview CVE-2026-8932 affects libcurl's connection reuse logic when mutual TLS mTLS configuration changes between requests. Under vulnerable conditions,...
curl: SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections
The core effect is a silent host-authentication bypass: a transfer whose configured SSH host-key policy would reject the server is served anyway, with exit code 0 and no warning, because it reuses a pooled connection established under a weaker or absent policy. curl may assess this lower because ...
CVE-2026-3805-curl-SMB-UAF
CVE-2026-3805: Use-After-Free in curl SMB Connection Reuse I found a use-after-free vulnerability in libcurl's SMB protocol handler. When a second SMB transfer reuses an existing connection to the same server, the file path for the new request req-path is a dangling pointer to freed heap memory...
curl: SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connection
Summary For SCP/SFTP, curl verifies the server's host key once, during the initial connect state machine, in sshcheckfingerprint — which reads CURLOPTSSHHOSTPUBLICKEYSHA256 / MD5, the CURLOPTSSHKNOWNHOSTS file, and the CURLOPTSSHHOSTKEYFUNCTION callback. That function has exactly one caller,...
curl: CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth
Summary When libcurl tunnels through an HTTP proxy with CONNECT HTTPS-over-proxy, the custom headers set via CURLOPTPROXYHEADER are sent to the proxy once, at tunnel-setup time lib/httpproxy.c:63-83. The connection-reuse decision for a proxied connection, however, does not take proxyheaders into...
CVE-2026-87861
A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests...
Astra Linux – Vulnerability in curl
libcurl will reuse a previously established connection even when options related to TLS or SSH have been changed, which should prevent such reuses. libcurl stores previously used connections in a connection pool, allowing for reuse if one of them matches the current setup. However, several TLS an...
curl: curl: cross-origin reuse of a Negotiate connection
A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests...
CURL-CVE-2026-86411 FTP connection reuse inherits client-certificate
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
CURL-CVE-2026-86415 auto client cert connection reuse mixup
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...