CLEANSTART-2026-ZI28814 Security fixes in curl 8.5.0-r0

Package curl version 8.5.0-r0 fixes 2 vulnerabilities: CVE-2023-46218, CVE-2023-46219...

CLEANSTART-2026-AX46117 Security fixes in curl 7.76.0-r0

Package curl version 7.76.0-r0 fixes 2 vulnerabilities: CVE-2021-22876, CVE-2021-22890...

CLEANSTART-2026-PL73907 Security fixes in curl 7.53.1-r2

Package curl version 7.53.1-r2 fixes 1 vulnerabilities: CVE-2017-7407...

CLEANSTART-2026-RT81570 Security fixes in curl 7.83.0-r0

Package curl version 7.83.0-r0 fixes 4 vulnerabilities: CVE-2022-22576, CVE-2022-27774, CVE-2022-27775, CVE-2022-27776...

CLEANSTART-2026-DU81055 Security fixes in curl 7.79.0-r0

Package curl version 7.79.0-r0 fixes 3 vulnerabilities: CVE-2021-22945, CVE-2021-22946, CVE-2021-22947...

CLEANSTART-2026-EQ22417 Security fixes in curl 7.78.0-r0

Package curl version 7.78.0-r0 fixes 4 vulnerabilities: CVE-2021-22922, CVE-2021-22923, CVE-2021-22924, CVE-2021-22925...

CLEANSTART-2026-NB70828 Security fixes in curl 7.61.1-r0

Package curl version 7.61.1-r0 fixes 1 vulnerabilities: CVE-2018-14618...

CLEANSTART-2026-EY72825 Security fixes in curl 7.86.0-r0

Package curl version 7.86.0-r0 fixes 4 vulnerabilities: CVE-2022-32221, CVE-2022-35260, CVE-2022-42915, CVE-2022-42916...

CLEANSTART-2026-BO02042 Security fixes in curl 7.36.0-r0

Package curl version 7.36.0-r0 fixes 2 vulnerabilities: CVE-2014-0138, CVE-2014-0139...

CLEANSTART-2026-WC02655 Security fixes in curl 7.71.0-r0

Package curl version 7.71.0-r0 fixes 2 vulnerabilities: CVE-2020-8169, CVE-2020-8177...

CLEANSTART-2026-HX55432 Security fixes in curl 8.9.0-r0

Package curl version 8.9.0-r0 fixes 2 vulnerabilities: CVE-2024-6197, CVE-2024-6874...

Curl 7.30.0 < 8.21.0 Wrong STARTTLS Connection Reuse

The version of curl installed on the remote host is 7.30.0 prior to 8.21.0. It is, therefore, affected by an improper certificate validation vulnerability: - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even thoug...

Curl 8.18.0 < 8.21.0 QUIC Zero-Length UDP Datagrams DoS

The version of curl installed on the remote host is 8.18.0 prior to 8.21.0. It is, therefore, affected by a denial of service vulnerability: - An issue in curl's QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service by continuously streaming empty...

Curl 8.11.0 < 8.21.0 HTTP/3 Early Data Information Disclosure

The version of curl installed on the remote host is 8.11.0 prior to 8.21.0. It is, therefore, affected by an information disclosure vulnerability: - When libcurl returns to a hostname with a cached SSL session and early data enabled, libcurl might send the request bytes before enforcing the...

JLSEC-2026-400

A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...

JLSEC-2026-394

When curl 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the...

Curl 8.17.0 < 8.20.0 OCSP Stapling Bypass

The version of curl installed on the remote host is 8.17.0 prior to 8.20.0. It is, therefore, affected by an OCSP stapling bypass vulnerability: - When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is...

Curl 7.14.1 < 8.20.0 Proxy Credential Disclosure

The version of curl installed on the remote host is 7.14.1 prior to 8.20.0. It is, therefore, affected by a proxy credential disclosure vulnerability: - curl might erroneously pass on credentials for a first proxy to a second proxy. This flaw occurs when different proxies are configured for...

[SECURITY] Fedora 42 Update: curl-8.11.1-8.fc42

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Curl 7.33.0 < 8.19.0 Token Leak with Redirect and Netrc

The version of curl installed on the remote host is 7.33.0 prior to 8.19.0. It is, therefore, affected by a token leak with redirect and netrc vulnerability: - When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that...