curl / Docs / Vulnerability table / 8.21.0 vulnerabilities

Vulnerabilities in curl 8.21.0

Related:
Audits
Changelog
curl CVEs
Vulnerability Disclosure
Vulnerabilities Table

curl version 8.21.0 was released on June 24 2026

It has the following 33 published security problems.

SFlawFirstLast
LCVE-2026-107929: local interface connection reuse mixup8.9.08.22.0
LCVE-2026-107928: info leak uploading over WebSockets with GnuTLS7.86.08.22.0
LCVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL7.62.08.22.0
LCVE-2026-94265: Authorization: Negotiate sent to foreign origin8.21.08.22.0
LCVE-2026-92386: server-set cookie aborts cookie jar load8.7.08.22.0
LCVE-2026-92387: never-ending loop via server response omission8.10.08.22.0
LCVE-2026-92388: FTP wildcard write callback mixup7.21.08.22.0
LCVE-2026-92389: TFTP direction confusion7.15.08.22.0
LCVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints7.20.08.22.0
LCVE-2026-92391: curl_mime_free stack overflow by recursion7.56.08.22.0
HCVE-2026-92392: HTTP/2 upload Use-After-Free8.12.08.22.0
LCVE-2026-86410: redirect to SFTP or SCP bypasses host verification7.81.08.22.0
LCVE-2026-86412: server-set cookie erases cookie jar8.18.08.22.0
LCVE-2026-86413: Negotiate credentials sent to redirected origin8.21.08.22.0
LCVE-2026-86414: leaking host credentials to HTTP proxy7.10.88.22.0
LCVE-2026-86415: auto client cert connection reuse mixup8.21.08.22.0
LCVE-2026-87861: cross-origin reuse of a Negotiate connection8.21.08.22.0
LCVE-2026-87862: HSTS cache import drops longer-lived child8.11.08.22.0
LCVE-2026-87863: HSTS response erases persisted entries8.2.08.22.0
LCVE-2026-87865: knownhost callback mismatches key as missing7.69.18.22.0
LCVE-2026-87866: wolfSSL public-key pinning bypass7.43.08.22.0
LCVE-2026-86409: stale SigV4 headers sent unintended7.75.08.21.0
LCVE-2026-86411: FTP connection reuse inherits client-certificate8.21.08.21.0
LCVE-2026-87864: IMAP APPEND plus CRLF conversion command injection7.30.08.21.0
LCVE-2026-82209: domain-scoped PSL domain cookie7.46.08.21.0
LCVE-2026-82208: wolfSSL CA-cache hit overrides callback8.9.18.21.0
LCVE-2026-80255: secure cookie attribute bypass with tab8.13.08.21.0
LCVE-2026-80231: native CA store conn reuse7.71.08.21.0
LCVE-2026-80230: OpenSSL pinning bypass7.45.08.21.0
LCVE-2026-80229: OpenSSL provider use-after-free8.14.08.21.0
MCVE-2026-19931: Negotiate ambient user conn reuse7.64.18.21.0
LCVE-2026-18924: HTTP/2 server push UAF7.44.08.21.0
LCVE-2026-13608: OpenLDAP SASL authentication bypass7.82.08.21.0

Further details

CVE data for 8.21.0 provided as JSON.

Changelog for curl 8.21.0

See vulnerability summary for the previous release: 8.20.0 or the subsequent release: 8.22.0