libcurl 代码问题漏洞

libcurl is an open-source, free, and easy-to-use client URL transfer library for cURL. There are code vulnerabilities in libcurl, stemming from a logical error in connection reuse logic. This error may lead to the incorrect reuse of connections that use different credentials after Negotiate...

CVE-2026-6429: Exposure of Sensitive Information to an Unauthorized Actor

When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances...

Unity Linux 20.1060e / 20.1070e Security Update: curl (UTSA-2026-017594)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017594 advisory. libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPTSSLCERT option --cert with the command li...

JLSEC-2026-434 Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted...

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS...

JLSEC-2026-426 When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl...

When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper chec...

JLSEC-2026-432 libcurl accidentally skips the certificate verification for QUIC connections when connecting to a...

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks...

JLSEC-2026-417 libcurl did not check the server certificate of TLS connections done to a host specified as an IP...

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate...

JLSEC-2026-421 libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection...

libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve...

JLSEC-2026-396

When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the...

JLSEC-2026-416 When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received...

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit 1000, libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead lea...

JLSEC-2026-422 When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with...

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the CURLOPTACCEPTENCODING option, using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would make libcurl perform a buffer overflow...

JLSEC-2026-427 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one...

When doing multi-threaded LDAPS transfers LDAP over TLS with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally...

JLSEC-2026-415 libcurl skips the certificate verification for a QUIC connection under certain conditions, when...

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems...

JLSEC-2026-390

libcurl provides the CURLOPTCERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation...

curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse

A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTPS request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connectio...

curl: libcurl: Credential leak via reused proxy connection during HTTP redirects

A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use...

curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse

A flaw was found in libcurl. Due to a logical error in the connection reuse mechanism for SMB Server Message Block transfers, libcurl might reuse an existing SMB connection with a different share than intended. This vulnerability, categorized as CWE-488 Exposure of Data Element to Wrong Session,...

curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers

A flaw was found in libcurl. This vulnerability allows for information disclosure when a custom Host: header is used in an initial HTTP request, and a subsequent request reuses the same connection without specifying a new Host: header. This can lead to libcurl incorrectly sending cookies intended...

libcurl 7.14.0 < 8.20.0 Netrc Password Leak on HTTP Redirect

The version of libcurl installed on the remote host is 7.14.0 prior to 8.20.0. It is, therefore, affected by a netrc password leak vulnerability: - When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the...

libcurl 7.12.0 < 8.20.0 Cross-Proxy Digest Auth State Leak

The version of libcurl installed on the remote host is 7.12.0 prior to 8.20.0. It is, therefore, affected by a cross-proxy digest auth state leak vulnerability: - libcurl improperly handles Digest authentication headers when reusing handles across different HTTP proxies. When a client switches fr...