[ Vendor · 24 CVEs ]
curl
CVEs affecting curl published in the last 30 days, plus any curl CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-94265 | 20 Oct 2026 | Not scored yet | curlWhen processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the… | |
| CVE-2026-94266 | 20 Oct 2026 | Not scored yet | curllibcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the… | |
| CVE-2026-92386 | 20 Oct 2026 | Not scored yet | curlWhen writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length… | |
| CVE-2026-92387 | 20 Oct 2026 | Not scored yet | curlBy permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its… | |
| CVE-2026-92388 | 20 Oct 2026 | Not scored yet | curlWhen an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the… | |
| CVE-2026-92389 | 20 Oct 2026 | Not scored yet | curllibcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for… | |
| CVE-2026-92390 | 20 Oct 2026 | Not scored yet | curlWhen invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints… | |
| CVE-2026-92391 | 20 Oct 2026 | Not scored yet | curlA deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An… | |
| CVE-2026-86415 | 20 Oct 2026 | Not scored yet | curllibcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel… | |
| CVE-2026-87861 | 20 Oct 2026 | Not scored yet | curlWhen using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via… | |
| CVE-2026-87862 | 20 Oct 2026 | Not scored yet | curlImporting a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires… | |
| CVE-2026-87863 | 20 Oct 2026 | Not scored yet | curlAn authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit… | |
| CVE-2026-87864 | 20 Oct 2026 | Not scored yet | curlEnabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded… | |
| CVE-2026-87865 | 20 Oct 2026 | Not scored yet | curlWhen libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a… | |
| CVE-2026-87866 | 20 Oct 2026 | Not scored yet | curlWhen built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS… | |
| CVE-2026-86414 | 20 Oct 2026 | Not scored yet | curlAn HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by… | |
| CVE-2026-107928 | 20 Oct 2026 | Not scored yet | curlWhen curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read… | |
| CVE-2026-107929 | 20 Oct 2026 | Not scored yet | curlWhen `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`)… | |
| CVE-2026-86409 | 20 Oct 2026 | Not scored yet | curlSetting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on… | |
| CVE-2026-86410 | 20 Oct 2026 | Not scored yet | curlA flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as… | |
| CVE-2026-86411 | 20 Oct 2026 | Not scored yet | curlAn `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS`… | |
| CVE-2026-86412 | 20 Oct 2026 | Not scored yet | curlA remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same… | |
| CVE-2026-86413 | 20 Oct 2026 | Not scored yet | curlWhen using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential… | |
| CVE-2026-92392 | 14 Oct 2026 | CVSS 8.1 | curlDuring an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use… |