[ { "schema_version": "1.5.0", "id": "CURL-CVE-2026-107929", "aliases": [ "CVE-2026-107929" ], "summary": "local interface connection reuse mixup", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-107929.json", "www": "https://curl.se/docs/CVE-2026-107929.html", "issue": "https://hackerone.com/reports/4099618", "CWE": { "id": "CWE-488", "desc": "Exposure of Data Element to Wrong Session" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.9.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "3060557af702dd59155ea703a0790455c2f49a59"}, {"fixed": "d37d79df1e01066417aff0a9e6bc675edad3edba"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0" ] } ], "credits": [ { "name": "Maksim Hayder", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address" }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-107928", "aliases": [ "CVE-2026-107928" ], "summary": "info leak uploading over WebSockets with GnuTLS", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-107928.json", "www": "https://curl.se/docs/CVE-2026-107928.html", "issue": "https://hackerone.com/reports/4099194", "CWE": { "id": "CWE-126", "desc": "Buffer Over-read" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.86.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "664249d095275ec532f55dd1752d80c8c1093a77"}, {"fixed": "64fb3e7a7b116f690966054f281624152d4a7651"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0" ] } ], "credits": [ { "name": "Luna with Claude", "type": "FINDER" }, { "name": "Anthropic", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-94266", "aliases": [ "CVE-2026-94266" ], "summary": "password leak in CURLINFO_EFFECTIVE_URL", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-94266.json", "www": "https://curl.se/docs/CVE-2026-94266.html", "issue": "https://hackerone.com/reports/4041053", "CWE": { "id": "CWE-522", "desc": "Insufficiently Protected Credentials" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.62.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "46e164069d1a5230e4e64cbd2ff46c46cce056bb"}, {"fixed": "7a6bd027d0de2b6857472d35da090ef60cc29f19"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0" ] } ], "credits": [ { "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-94265", "aliases": [ "CVE-2026-94265" ], "summary": "Authorization: Negotiate sent to foreign origin", "modified": "2026-09-21T16:23:00.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-94265.json", "www": "https://curl.se/docs/CVE-2026-94265.html", "issue": "https://hackerone.com/reports/4040551", "CWE": { "id": "CWE-200", "desc": "Exposure of Sensitive Information to an Unauthorized Actor" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "8f71d0fde515aa4c68002477356c35bd79927729"}, {"fixed": "557a52f21e37a626725a9e708c02af129c3ece1b"} ] } ], "versions": [ "8.22.0", "8.21.0" ] } ], "credits": [ { "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { "name": "Joshua Rogers (Aisle Research)", "type": "REMEDIATION_DEVELOPER" } ], "details": "When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-92386", "aliases": [ "CVE-2026-92386" ], "summary": "server-set cookie aborts cookie jar load", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-92386.json", "www": "https://curl.se/docs/CVE-2026-92386.html", "issue": "https://hackerone.com/reports/4021979", "CWE": { "id": "CWE-1284", "desc": "Improper Validation of Specified Quantity in Input" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.7.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "142ac257b3242459b284020c59f1902b9687a954"}, {"fixed": "445aa87e13f91c94bc742f54343a2eac924e1765"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0" ] } ], "credits": [ { "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-92387", "aliases": [ "CVE-2026-92387" ], "summary": "never-ending loop via server response omission", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-92387.json", "www": "https://curl.se/docs/CVE-2026-92387.html", "issue": "https://hackerone.com/reports/4022003", "CWE": { "id": "CWE-835", "desc": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.10.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "a5598b6fcb9ec6b57a7770939a0ffb004456f333"}, {"fixed": "753735af87f5c30cb6f60a70342f8bc4bc5fd5db"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0" ] } ], "credits": [ { "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-92388", "aliases": [ "CVE-2026-92388" ], "summary": "FTP wildcard write callback mixup", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2026-92388.json", "www": "https://curl.se/docs/CVE-2026-92388.html", "issue": "https://hackerone.com/reports/4022070", "CWE": { "id": "CWE-416", "desc": "Use After Free" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.21.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "0825cd80a62c21725fb3615f1fdd3aa6cc5f0f34"}, {"fixed": "ba8f8a7f27a5c5e19e4ef212b90b35a93559163e"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0" ] } ], "credits": [ { "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-92389", "aliases": [ "CVE-2026-92389" ], "summary": "TFTP direction confusion", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2026-92389.json", "www": "https://curl.se/docs/CVE-2026-92389.html", "issue": "https://hackerone.com/reports/4022568", "CWE": { "id": "CWE-200", "desc": "Exposure of Sensitive Information to an Unauthorized Actor" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.15.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "56d9624b566ac15ffb4b4b6eef220a5000b767e0"}, {"fixed": "63dd390fab905a239a97e2700532929343ebc4e9"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0" ] } ], "credits": [ { "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-92390", "aliases": [ "CVE-2026-92390" ], "summary": "-J no-clobber guarantee bypassed with 103 early hints", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "tool", "URL": "https://curl.se/docs/CVE-2026-92390.json", "www": "https://curl.se/docs/CVE-2026-92390.html", "issue": "https://hackerone.com/reports/4023192", "CWE": { "id": "CWE-73", "desc": "External Control of File Name or Path" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.20.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "80675818e0417be8c991513b328c5507e93b47e5"}, {"fixed": "c24a69d8cd368de4e25e3540bf0b7b000a31d5a7"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0" ] } ], "credits": [ { "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { "name": "Joshua Rogers (Aisle Research)", "type": "REMEDIATION_DEVELOPER" } ], "details": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-92391", "aliases": [ "CVE-2026-92391" ], "summary": "curl_mime_free stack overflow by recursion", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2026-92391.json", "www": "https://curl.se/docs/CVE-2026-92391.html", "issue": "https://hackerone.com/reports/4024222", "CWE": { "id": "CWE-674", "desc": "Uncontrolled Recursion" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.56.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ce0881edee3c78609eae49665fb70264d8786d29"}, {"fixed": "d7546809d5bd548b69ec49fca26565c8f6f0d344"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0" ] } ], "credits": [ { "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-92392", "aliases": [ "CVE-2026-92392" ], "summary": "HTTP/2 upload Use-After-Free", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-92392.json", "www": "https://curl.se/docs/CVE-2026-92392.html", "issue": "https://hackerone.com/reports/4030333", "CWE": { "id": "CWE-416", "desc": "Use After Free" }, "last_affected": "8.22.0", "severity": "High" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.12.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "cd9107e0128191b7b5396b9eb81bbd20c2d36755"}, {"fixed": "8b0744af5b1b631da5b938ca31c3f9895ad5a321"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0" ] } ], "credits": [ { "name": "Luna with Claude", "type": "FINDER" }, { "name": "Anthropic", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-86410", "aliases": [ "CVE-2026-86410" ], "summary": "redirect to SFTP or SCP bypasses host verification", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "tool", "URL": "https://curl.se/docs/CVE-2026-86410.json", "www": "https://curl.se/docs/CVE-2026-86410.html", "issue": "https://hackerone.com/reports/3973176", "CWE": { "id": "CWE-297", "desc": "Improper Validation of Certificate with Host Mismatch" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.81.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-86412", "aliases": [ "CVE-2026-86412" ], "summary": "server-set cookie erases cookie jar", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-86412.json", "www": "https://curl.se/docs/CVE-2026-86412.html", "issue": "https://hackerone.com/reports/3973201", "CWE": { "id": "CWE-754", "desc": "Improper Check for Unusual or Exceptional Conditions" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.18.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "3f0629ca443825916cbc0795bcd5f241fbf7104c"}, {"fixed": "6ded3e594455d6f018fab5f2f5d916eb9bc4ef94"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-86413", "aliases": [ "CVE-2026-86413" ], "summary": "Negotiate credentials sent to redirected origin", "modified": "2026-10-14T08:17:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-86413.json", "www": "https://curl.se/docs/CVE-2026-86413.html", "issue": "https://hackerone.com/reports/3993549", "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "8f71d0fde515aa4c68002477356c35bd79927729"}, {"fixed": "43029e2ec37eba2354ced199ccd8898de695858e"} ] } ], "versions": [ "8.22.0", "8.21.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-86414", "aliases": [ "CVE-2026-86414" ], "summary": "leaking host credentials to HTTP proxy", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-86414.json", "www": "https://curl.se/docs/CVE-2026-86414.html", "issue": "https://hackerone.com/reports/3993566", "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.10.8"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "52ceab5e41a01b4d1227876d51a3680a3ce5a841"}, {"fixed": "2956af6c7451029fb12c12f8166dff211f930d52"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", "7.28.1", "7.28.0", "7.27.0", "7.26.0", "7.25.0", "7.24.0", "7.23.1", "7.23.0", "7.22.0", "7.21.7", "7.21.6", "7.21.5", "7.21.4", "7.21.3", "7.21.2", "7.21.1", "7.21.0", "7.20.1", "7.20.0", "7.19.7", "7.19.6", "7.19.5", "7.19.4", "7.19.3", "7.19.2", "7.19.1", "7.19.0", "7.18.2", "7.18.1", "7.18.0", "7.17.1", "7.17.0", "7.16.4", "7.16.3", "7.16.2", "7.16.1", "7.16.0", "7.15.5", "7.15.4", "7.15.3", "7.15.2", "7.15.1", "7.15.0", "7.14.1", "7.14.0", "7.13.2", "7.13.1", "7.13.0", "7.12.3", "7.12.2", "7.12.1", "7.12.0", "7.11.2", "7.11.1", "7.11.0", "7.10.8" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-86415", "aliases": [ "CVE-2026-86415" ], "summary": "auto client cert connection reuse mixup", "modified": "2026-10-14T08:17:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-86415.json", "www": "https://curl.se/docs/CVE-2026-86415.html", "issue": "https://hackerone.com/reports/3993870", "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "d69bfad3fa3daf5e72331f6870667607828d5891"}, {"fixed": "00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9"} ] } ], "versions": [ "8.22.0", "8.21.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-87861", "aliases": [ "CVE-2026-87861" ], "summary": "cross-origin reuse of a Negotiate connection", "modified": "2026-10-14T08:17:29.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-87861.json", "www": "https://curl.se/docs/CVE-2026-87861.html", "issue": "https://hackerone.com/reports/3972094", "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "bd10924b47c8bf94127eaee8c56e7b5e5418da46"}, {"fixed": "7c11f1a1bd53e2cd983fe153e45991302d097647"} ] } ], "versions": [ "8.22.0", "8.21.0" ] } ], "credits": [ { "name": "Axel Mierczuk", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-87862", "aliases": [ "CVE-2026-87862" ], "summary": "HSTS cache import drops longer-lived child", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-87862.json", "www": "https://curl.se/docs/CVE-2026-87862.html", "issue": "https://hackerone.com/reports/3972357", "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.11.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "a94973805df96269bf3f3bf0a20ccb9887313316"}, {"fixed": "a1614c3bcf1593eb524b37792124357d97a5429c"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-87863", "aliases": [ "CVE-2026-87863" ], "summary": "HSTS response erases persisted entries", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-87863.json", "www": "https://curl.se/docs/CVE-2026-87863.html", "issue": "https://hackerone.com/reports/3972373", "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.2.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "0c667188e0c6cda615a036b8a2b4125f2c404dde"}, {"fixed": "08d50a791b3197a3d0a4fc2f778e243f5501c67e"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-87865", "aliases": [ "CVE-2026-87865" ], "summary": "knownhost callback mismatches key as missing", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-87865.json", "www": "https://curl.se/docs/CVE-2026-87865.html", "issue": "https://hackerone.com/reports/3975408", "CWE": { "id": "CWE-295", "desc": "Improper Certificate Validation" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.69.1"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "e96fe70cabcb3a5a009821dbb453dc0160ddc3f5"}, {"fixed": "323c184b6bdf5b1988a10c0a61560666e1588149"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1" ] } ], "credits": [ { "name": "Bobbeh Rhino", "type": "FINDER" }, { "name": "Bobbeh Rhino", "type": "REMEDIATION_DEVELOPER" } ], "details": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-87866", "aliases": [ "CVE-2026-87866" ], "summary": "wolfSSL public-key pinning bypass", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-87866.json", "www": "https://curl.se/docs/CVE-2026-87866.html", "issue": "https://hackerone.com/reports/3989514", "CWE": { "id": "CWE-295", "desc": "Improper Certificate Validation" }, "last_affected": "8.22.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.43.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.23.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "0675abbc7572ff6d711a1f325d9b812f98bce78f"}, {"fixed": "ed131747c1a3dc7f816d26724c44537ac8acba44"} ] } ], "versions": [ "8.22.0", "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0" ] } ], "credits": [ { "name": "Muhamad Arga Reksapati", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-86409", "aliases": [ "CVE-2026-86409" ], "summary": "stale SigV4 headers sent unintended", "modified": "2026-10-20T13:32:03.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2026-86409.json", "www": "https://curl.se/docs/CVE-2026-86409.html", "issue": "https://hackerone.com/reports/3973135", "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.75.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "08e8455dddc5e48e58a12ade3815c01ae3da3b64"}, {"fixed": "c3c70440e8d9938c0bb732595751e8aebc614f24"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Viktor Szakats", "type": "REMEDIATION_DEVELOPER" } ], "details": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nis set next, leaking state information." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-86411", "aliases": [ "CVE-2026-86411" ], "summary": "FTP connection reuse inherits client-certificate", "modified": "2026-09-09T11:42:42.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-86411.json", "www": "https://curl.se/docs/CVE-2026-86411.html", "issue": "https://hackerone.com/reports/3973190", "CWE": { "id": "CWE-488", "desc": "Exposure of Data Element to Wrong Session" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "4ff212f8ed328fb95261e11add8f4d2f0616895a"}, {"fixed": "72352daba01ba8072b6c1c0254cb77860ed1ab06"} ] } ], "versions": [ "8.21.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-87864", "aliases": [ "CVE-2026-87864" ], "summary": "IMAP APPEND plus CRLF conversion command injection", "modified": "2026-09-17T12:57:32.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-87864.json", "www": "https://curl.se/docs/CVE-2026-87864.html", "issue": "https://hackerone.com/reports/3972403", "CWE": { "id": "CWE-130", "desc": "Improper Handling of Length Parameter Inconsistency" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-10-14T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.30.0"}, {"fixed": "8.14.3"}, {"introduced": "8.15.0"}, {"fixed": "8.16.2"}, {"introduced": "8.17.0"}, {"fixed": "8.20.2"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "f8c8c76d39ac2fa825481ba42ab2247cd122f963"}, {"fixed": "3b547de301342b347fb3c6ea6ae7979070793a66"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-82209", "aliases": [ "CVE-2026-82209" ], "summary": "domain-scoped PSL domain cookie", "modified": "2026-10-08T17:01:28.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-82209.json", "www": "https://curl.se/docs/CVE-2026-82209.html", "issue": "https://hackerone.com/reports/3972385", "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-09-02T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.46.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "e77b5b7453c1e8ccd7ec0816890d98e2f392e465"}, {"fixed": "95c1e8915dce64606bd753fd47fc0bd236e31cd6"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-82208", "aliases": [ "CVE-2026-82208" ], "summary": "wolfSSL CA-cache hit overrides callback", "modified": "2026-10-08T17:01:28.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2026-82208.json", "www": "https://curl.se/docs/CVE-2026-82208.html", "issue": "https://hackerone.com/reports/3973090", "CWE": { "id": "CWE-295", "desc": "Improper Certificate Validation" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-09-02T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.9.1"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "0f2876b2c33f6784a27b6f7345bd8cd95b46352a"}, {"fixed": "ed0338befd1d865a8ea1fbaa90013a096dedd07a"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "With the wolfSSL backend, when CA caching is enabled and an\n`CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can\nsilently reinstall the cached store after the callback returns. A certificate\ntrusted by the cached store but rejected by the callback-selected store is\nthen incorrectly accepted." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-80255", "aliases": [ "CVE-2026-80255" ], "summary": "secure cookie attribute bypass with tab", "modified": "2026-10-13T13:40:51.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-80255.json", "www": "https://curl.se/docs/CVE-2026-80255.html", "issue": "https://hackerone.com/reports/3972395", "CWE": { "id": "CWE-201", "desc": "Information Exposure Through Sent Data" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-09-02T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.13.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "1aea05a6c2699e80c75936d58569851555acd603"}, {"fixed": "4f6aa41a0145e930e766775dbe860883d350aa0a"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of\nspace (ascii code 32) immediately before the `Secure` attribute causes curl to\nstore the cookie without its Secure flag. The cookie might then wrongfully be\nsent over plaintext HTTP on subsequent requests to the same host." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-80231", "aliases": [ "CVE-2026-80231" ], "summary": "native CA store conn reuse", "modified": "2026-10-08T17:01:28.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-80231.json", "www": "https://curl.se/docs/CVE-2026-80231.html", "issue": "https://hackerone.com/reports/3969368", "CWE": { "id": "CWE-488", "desc": "Exposure of Data Element to Wrong Session" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-09-02T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.71.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "148534db57dda611cf8516e92e4d6e35fc1e5074"}, {"fixed": "7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-80230", "aliases": [ "CVE-2026-80230" ], "summary": "OpenSSL pinning bypass", "modified": "2026-10-08T17:01:28.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-80230.json", "www": "https://curl.se/docs/CVE-2026-80230.html", "issue": "https://hackerone.com/reports/3969300", "CWE": { "id": "CWE-295", "desc": "Improper Certificate Validation" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-09-02T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.45.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "8363656cb4e0c60a11d8531ead0ec43120b50591"}, {"fixed": "5267ed859d545534d0c21675a2b70af5a3b6e3ef"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-80229", "aliases": [ "CVE-2026-80229" ], "summary": "OpenSSL provider use-after-free", "modified": "2026-10-08T17:01:28.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-80229.json", "www": "https://curl.se/docs/CVE-2026-80229.html", "issue": "https://hackerone.com/reports/3969255", "CWE": { "id": "CWE-416", "desc": "Use After Free" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-09-02T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "8.14.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "f2ce6c46b9dcc46ced0ce43fa95176ea7599a854"}, {"fixed": "7ea37abc6ac0120ba5f6d94be8d196f7cf1506bb"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0" ] } ], "credits": [ { "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-19931", "aliases": [ "CVE-2026-19931" ], "summary": "Negotiate ambient user conn reuse", "modified": "2026-10-08T17:01:28.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-19931.json", "www": "https://curl.se/docs/CVE-2026-19931.html", "issue": "https://hackerone.com/reports/3923520", "CWE": { "id": "CWE-488", "desc": "Exposure of Data Element to Wrong Session" }, "last_affected": "8.21.0", "severity": "Medium" }, "published": "2026-09-02T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.64.1"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "6c6035532383e300c712e4c1cd9fdd749ed5cf59"}, {"fixed": "7103a93b05bc69ea98ed9d05d02fa9eeba533f2f"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1" ] } ], "credits": [ { "name": "Martin Dukek", "type": "FINDER" }, { "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ], "details": "A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-18924", "aliases": [ "CVE-2026-18924" ], "summary": "HTTP/2 server push UAF", "modified": "2026-10-08T17:01:28.00Z", "database_specific": { "package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2026-18924.json", "www": "https://curl.se/docs/CVE-2026-18924.html", "issue": "https://hackerone.com/reports/3916059", "CWE": { "id": "CWE-416", "desc": "Use After Free" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-09-02T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.44.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "ea7134ac874a66107e54ff93657ac565cf2ec4aa"}, {"fixed": "90325ff0444cbdff368bda5d26d6405a0bb6ee43"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0" ] } ], "credits": [ { "name": "Stephan Zeisberg (Security Research Labs)", "type": "FINDER" }, { "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ], "details": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process." }, { "schema_version": "1.5.0", "id": "CURL-CVE-2026-13608", "aliases": [ "CVE-2026-13608" ], "summary": "OpenLDAP SASL authentication bypass", "modified": "2026-10-08T17:01:28.00Z", "database_specific": { "package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-13608.json", "www": "https://curl.se/docs/CVE-2026-13608.html", "issue": "https://hackerone.com/reports/3822248", "CWE": { "id": "CWE-923", "desc": "Improper Restriction of Communication Channel to Intended Endpoints" }, "last_affected": "8.21.0", "severity": "Low" }, "published": "2026-09-02T08:00:00.00Z", "affected": [ { "ranges": [ { "type": "SEMVER", "events": [ {"introduced": "7.82.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"} ] }, { "type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [ {"introduced": "eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4"}, {"fixed": "ea71c3b6b60e563651ea8596a975aef0c8199519"} ] } ], "versions": [ "8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0" ] } ], "credits": [ { "name": "Eunsoo Kim (Autonomous Code Security team at Microsoft)", "type": "FINDER" }, { "name": "Eunsoo Kim", "type": "REMEDIATION_DEVELOPER" } ], "details": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation." }]