ROOT-OS-ALPINE-322-CVE-2026-11856 CVE-2026-11856 in curl - Patched by Root

Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-9545 CVE-2026-9545 in curl - Patched by Root

Root has patched CVE-2026-9545 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-12064 CVE-2026-12064 in curl - Patched by Root

Root has patched CVE-2026-12064 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-8926 CVE-2026-8926 in curl - Patched by Root

Root has patched CVE-2026-8926 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...

Astra Linux – Vulnerability in curl

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname, but the...

Astra Linux – vulnerability in curl

A authentication bypass vulnerability exists in libcurl versions 8.0.0 within the connection reuse feature. This allows connections previously established to be reused under incorrect user permissions, due to a failure to verify any changes in the CURLOPTGSSAPIDELEGATION option. The vulnerability...

Astra Linux – vulnerability in curl

A user can specify that curl version = 7.20.0 and = 7.78.0 must perform a successful TLS upgrade when communicating with an IMAP, POP3, or FTP server by using --ssl-reqd on the command line or setting CURLOPTUSESSL to CURLUSESSLCONTROL or CURLUSESSLALL via libcurl. This requirement can be...

Astra Linux – vulnerability in curl

This flaw allows an attacker to insert cookies at will into a running program using libcurl, provided that a specific set of conditions is met. Libcurl performs transfers. Within its API, an application creates “easy handles” which serve as individual handles for individual transfers. Libcurl...

Astra Linux – Vulnerability in curl

When the curl command is used to retrieve content using the Metalink feature, and a user name and password are used to download the Metalink XML file, those same credentials are then passed to each server from which the curl command will attempt to download or retrieve the content. This often...

Astra Linux – Vulnerability in curl

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3, or SMTP scheme, curl may incorrectly pass the bearer token to the new target host...

Astra Linux – vulnerability in curl

When performing multi-threaded LDAPS transfers LDAP over TLS using libcurl, changing TLS options in one thread may inadvertently affect them globally, potentially impacting other concurrent transfers as well. Disabling certificate verification for a single transfer might also unintentionally...

Astra Linux – vulnerability in curl

When curl 7.84.0 performs FTP transfers secured by krb5, it fails to properly handle message verification errors. This flaw allows Man-In-The-Middle attacks to go undetected and even enables attackers to inject data into the client...

Astra Linux – vulnerability in curl

curl versions prior to 7.84.0 support “chained” HTTP compression algorithms; this means a server response can be compressed multiple times using different algorithms. The number of allowable “links” within this “decompression chain” is virtually unlimited, enabling a malicious server to insert an...

Astra Linux – vulnerability in curl

A resource allocation vulnerability exists in curl versions up to and including v7.88.0; it stems from the “chained” HTTP compression algorithms. This allows a server response to be compressed multiple times, potentially using different algorithms each time. Although there is a limit on the numbe...

Astra Linux – Vulnerability in curl

When curl is used to retrieve and parse cookies from an HTTPS server, it accepts cookies using control codes that, when sent back to an HTTP server later, may cause the server to return 400 responses. This effectively allows a “sister site” to deny service to all other sibling sites...

Astra Linux – Vulnerability in curl

A poorly protected credentials vulnerability exists in curl 4.9, and versions including curl 7.82.0 are also affected. This vulnerability could allow attackers to extract credentials when using HTTPS redirections with authentication. As a result, credentials may be leaked to other services that...

Astra Linux – vulnerability in curl

Curl versions 7.1.1 through 7.75.0 are vulnerable to an “Exposure of Private Personal Information to an Unauthorized Actor” issue, as it leaks credentials via the HTTP Referer: header. libcurl fails to remove user credentials from URLs when automatically populating the Referer: HTTP request heade...

Astra Linux – Vulnerability in curl

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take ‘issuercert’ into account, and it compared the involved paths case insensitively, which could...

Astra Linux – vulnerability in curl

This flaw enables a malicious HTTP server to set “super cookies” in curl that are subsequently forwarded to multiple origins beyond what is normally permitted or possible. As a result, a site can set cookies that are then sent to different and unrelated sites and domains. This can be achieved by...

Astra Linux – vulnerability in curl

When curl version 7.20.0 through 7.78.0 connects to an IMAP or POP3 server to retrieve data via STARTTLS to establish TLS encryption, the server may respond and return multiple cached responses simultaneously. curl then upgrades to TLS, but does not flush those cached responses; instead, it...