PT-2026-84654

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A heap-use-after-free occurs when using libcurl's multi interface with OpenSSL 3 provider configurations. The issue arises because libcurl attaches an allocated library context to the easy...

PT-2026-84651

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description A flaw exists in the handling of HTTP/2 Server Push streams. When the parent handle is configured to share connections with other handles, a use-after-free condition can occur during the...

PT-2026-84656

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A flaw in libcurl causes the software to incorrectly reuse an existing HTTPS connection setup for a specific hostname, even if a different Native CA Store setting CURLSSLOPT NATIVE CA is used...

PT-2026-84659

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description When libpsl support is enabled, the software fails to enforce the Public Suffix List boundary check while processing a Set-Cookie header. This occurs when the Domain attribute explicitly matches...

PT-2026-84650

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description A flaw in the SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker performing a...

PT-2026-84658

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description When using the wolfSSL backend with CA caching enabled, a flaw exists where the CURLOPT SSL CTX FUNCTION callback can be overridden. If this callback replaces the trust store, libcurl may...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana OnPrem build 1.0.323 Vulnerability Details CVEID:CVE-2026-48776 DESCRIPTION: LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python...

curl: 46: `--libcurl` output carries `--insecure` across `--next` boundaries

Summary When --libcurl generates C source for a command that uses --next to separate multiple operations, local options from earlier operations leak into later ones. Specifically, if the first operation uses --insecure and the second does not, the generated program silently skips TLS certificate...

curl: Unbound cross-peer HTTP Digest challenge state

Summary When libcurl parses an HTTP Digest WWW-Authenticate challenge, it stores the realm, nonce, algorithm, and qop into the easy handle's state.digest — but does not bind that state to the peer that sent it. If the challenge is parsed but never used for output e.g. because Basic or Bearer was...

EulerOS Virtualization 2.13.1 : curl (EulerOS-SA-2026-3169)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a...

Astra Linux – Vulnerability in curl

libcurl provides the CURLOPTCERTINFO option to allow applications to request details about a server’s certificate chain. Due to a faulty function, a malicious server could cause libcurl, built with NSS, to get stuck in an endless busy-loop when attempting to retrieve that information...

Astra Linux – Vulnerability in curl

When performing HTTPS transfers, libcurl may incorrectly use the read callback CURLOPTREADFUNCTION to request data to be sent, even when the CURLOPTPOSTFIELDS option has been set. This occurs if the same handle was previously used to issue a PUT request that utilized that callback. This flaw may...

Astra Linux – Vulnerability in curl

When an application instructs libcurl to enable HTTP/2 server push, and the number of received headers for the push exceeds the maximum allowed limit 1000, libcurl abends the server push. During this process, libcurl inadvertently does not free all of the previously allocated headers; instead, it...

Tenable Security Center < 6.9.0 Multiple Vulnerabilities (TNS-2026-22)

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-22 advisory. - libcurl might in some circumstances reuse the wrong connection for SMBS transfers...

RLSA-2026:57462 Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements:...

ALSA-2026:57462 Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements:...

Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements:...

curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...

curl: libcurl: Unauthorized connection reuse due to a logical error

A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different...

libcurl: libcurl: Information disclosure via cached SSL session and early data

A flaw was found in libcurl. An attacker can exploit this by replacing a legitimate HTTP/3 server with an impostor machine. When libcurl attempts a second transfer to the same site with a cached SSL session and early data enabled, it may send sensitive request data before verifying the server's...