CVE-2026-107929

When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...

EUVD-2026-105359

When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...

CVE-2026-94266

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

EUVD-2026-105355

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

CVE-2026-94266

libcurl could accidentally return a URL for "curleasygetinfo"'s "CURLINFOEFFECTIVEURL" option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

CVE-2026-94266 password leak in CURLINFO_EFFECTIVE_URL

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

CVE-2026-94266

The libcurl library is vulnerable to a password leak flaw where the curl_easy_getinfo() function, when requesting the CURLINFO_EFFECTIVE_URL option, can inadvertently return a URL containing secret credentials. This occurs specifically when credentials are retrieved from a local configuration fil...

CVE-2026-94266

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

CVE-2026-92391

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process...

CVE-2026-92391

The libcurl library is vulnerable to a stack overflow caused by excessive recursion depth within the curl_mime_free function. An attacker can exploit this by providing a deeply nested multipart MIME structure via the public API, which leads to unbounded stack frame allocation during normal cleanu...

EUVD-2026-105322

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process...

CVE-2026-92391

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within "curlmimefree" leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host proces...

CVE-2026-92391

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process...

CVE-2026-92389

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389

The libcurl TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can exploit this by responding to a download request in a way that forces the client i...

EUVD-2026-105319

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92389

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-92388

When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash,...

CVE-2026-92388

The libcurl library is vulnerable to a write callback mixup during failed FTP wildcard LIST operations. The root cause is that libcurl fails to restore the restoration path, leaving the write callback set to the internal listing parser and the data pointer directed at the easy handle . This state...