856 matches found
CVE-2026-8932
🚨 CVE-2026-8932 - The Oldest libcurl Security Bug Incomplete mTLS Configuration Matching in libcurl The oldest security vulnerability ever fixed in libcurl—remaining unnoticed for over 25 years. 📖 Overview CVE-2026-8932 is a security vulnerability in libcurl where the library may incorrectly reus...
CVE-2026-114637
A flaw was found in Traefik. The FastProxy connection pool fails to properly bind authenticated backend connections to their specific client sessions. An unauthenticated remote attacker can be assigned a reused connection previously authenticated by another user via NTLM NT LAN Manager or Negotia...
EUVD-2026-116966
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...
CVE-2026-121966: traefik: Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url…
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...
libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse
A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security mTLS settings, particularly those for client certificates, should have prevented such reuse...
curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication
A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...
Rocky Linux 9 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc (crlsa-2026_92907)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202692907 advisory. libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 Tenable has extracted the preceding description block directly from t...
CVE-2026-3805-curl-SMB-UAF
CVE-2026-3805: Use-After-Free in curl SMB Connection Reuse I found a use-after-free vulnerability in libcurl's SMB protocol handler. When a second SMB transfer reuses an existing connection to the same server, the file path for the new request req-path is a dangling pointer to freed heap memory...
RLSA-2026:92907 Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 For more details about the...
curl security update
An update is available for curl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...
CVE-2026-8932-PoC
CVE-2026-8932 PoC Proof-of-concept reproduction of CVE-2026-8932 , an incomplete mTLS configuration matching issue in libcurl connection reuse. Overview CVE-2026-8932 affects libcurl's connection reuse logic when mutual TLS mTLS configuration changes between requests. Under vulnerable conditions,...
RockyLinux 9 : curl (RLSA-2026:92907)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:92907 advisory. libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 Tenable has extracted the preceding description block directly from...
RLSA-2026:92368 Important: curl security, bug fix, and enhancement update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: libcurl: Unauthorized...
Moderate: Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse
A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security mTLS settings, particularly those for client certificates, should have prevented such reuse...
AlmaLinux 9 : curl (ALSA-2026:92907)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:92907 advisory. libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 Tenable has extracted the preceding description block directly from...
RHEL 9 : curl (RHSA-2026:92907)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92907 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP,...
Oracle Linux 9 : curl (ELSA-2026-92907)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-92907 advisory. 7.76.1-40.el98.9 - fix incomplete mTLS config in connection reuse CVE-2026-8932 Tenable has extracted the preceding description block directly from the Oracle...
Important: Red Hat Security Advisory: curl security, bug fix, and enhancement update
An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse
A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security mTLS settings, particularly those for client certificates, should have prevented such reuse...