https://vulnogram.org/ Most recent CVEs assigned by curl (curl). https://vulnogram.org/seaview/icons/curl.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-107929 https://vulnogram.org/CVE-2026-107929 When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source… Tue, 20 Oct 2026 20:29:28 GMT https://vulnogram.org/CVE-2026-107928 https://vulnogram.org/CVE-2026-107928 When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes… Tue, 20 Oct 2026 20:28:17 GMT https://vulnogram.org/CVE-2026-94266 https://vulnogram.org/CVE-2026-94266 libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. Tue, 20 Oct 2026 20:27:21 GMT https://vulnogram.org/CVE-2026-94265 https://vulnogram.org/CVE-2026-94265 When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a red… Tue, 20 Oct 2026 20:26:18 GMT https://vulnogram.org/CVE-2026-92391 https://vulnogram.org/CVE-2026-92391 A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structu… Tue, 20 Oct 2026 20:24:10 GMT https://vulnogram.org/CVE-2026-92390 https://vulnogram.org/CVE-2026-92390 When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Dispos… Tue, 20 Oct 2026 20:23:08 GMT https://vulnogram.org/CVE-2026-92389 https://vulnogram.org/CVE-2026-92389 libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a wa… Tue, 20 Oct 2026 20:21:45 GMT https://vulnogram.org/CVE-2026-92388 https://vulnogram.org/CVE-2026-92388 When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent… Tue, 20 Oct 2026 20:20:41 GMT https://vulnogram.org/CVE-2026-92387 https://vulnogram.org/CVE-2026-92387 By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same… Tue, 20 Oct 2026 20:19:14 GMT https://vulnogram.org/CVE-2026-92386 https://vulnogram.org/CVE-2026-92386 When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using… Tue, 20 Oct 2026 20:17:37 GMT https://vulnogram.org/CVE-2026-87866 https://vulnogram.org/CVE-2026-87866 When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - trick… Tue, 20 Oct 2026 20:16:30 GMT https://vulnogram.org/CVE-2026-87865 https://vulnogram.org/CVE-2026-87865 When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback. Tue, 20 Oct 2026 20:15:13 GMT https://vulnogram.org/CVE-2026-87863 https://vulnogram.org/CVE-2026-87863 An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exc… Tue, 20 Oct 2026 20:13:22 GMT https://vulnogram.org/CVE-2026-87864 https://vulnogram.org/CVE-2026-87864 Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be inter… Tue, 20 Oct 2026 20:13:13 GMT https://vulnogram.org/CVE-2026-87862 https://vulnogram.org/CVE-2026-87862 Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than u… Tue, 20 Oct 2026 20:10:37 GMT https://vulnogram.org/CVE-2026-87861 https://vulnogram.org/CVE-2026-87861 When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused. Tue, 20 Oct 2026 20:09:28 GMT https://vulnogram.org/CVE-2026-86415 https://vulnogram.org/CVE-2026-86415 libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code expl… Tue, 20 Oct 2026 20:08:29 GMT https://vulnogram.org/CVE-2026-86414 https://vulnogram.org/CVE-2026-86414 An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Auth… Tue, 20 Oct 2026 20:07:22 GMT https://vulnogram.org/CVE-2026-86413 https://vulnogram.org/CVE-2026-86413 When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there. Tue, 20 Oct 2026 20:06:11 GMT https://vulnogram.org/CVE-2026-86412 https://vulnogram.org/CVE-2026-86412 A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure repl… Tue, 20 Oct 2026 20:03:28 GMT https://vulnogram.org/CVE-2026-86411 https://vulnogram.org/CVE-2026-86411 An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake… Tue, 20 Oct 2026 20:02:03 GMT https://vulnogram.org/CVE-2026-86410 https://vulnogram.org/CVE-2026-86410 A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. Tue, 20 Oct 2026 19:59:26 GMT https://vulnogram.org/CVE-2026-86409 https://vulnogram.org/CVE-2026-86409 Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, le… Tue, 20 Oct 2026 19:57:01 GMT https://vulnogram.org/CVE-2026-92392 https://vulnogram.org/CVE-2026-92392 During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object. High Network Exploitable Wed, 14 Oct 2026 07:46:15 GMT https://vulnogram.org/CVE-2026-82209 https://vulnogram.org/CVE-2026-82209 When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` s… High Network Exploitable Sun, 06 Sep 2026 17:49:35 GMT https://vulnogram.org/CVE-2026-82208 https://vulnogram.org/CVE-2026-82208 With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but reject… High Network Exploitable Sun, 06 Sep 2026 17:49:16 GMT https://vulnogram.org/CVE-2026-80255 https://vulnogram.org/CVE-2026-80255 A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintex… High Network Exploitable Sun, 06 Sep 2026 17:48:54 GMT https://vulnogram.org/CVE-2026-80231 https://vulnogram.org/CVE-2026-80231 A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created. High Network Exploitable Sun, 06 Sep 2026 17:48:38 GMT https://vulnogram.org/CVE-2026-80230 https://vulnogram.org/CVE-2026-80230 When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a p… High Network Exploitable Sun, 06 Sep 2026 17:48:16 GMT https://vulnogram.org/CVE-2026-80229 https://vulnogram.org/CVE-2026-80229 When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it t… High Network Exploitable Sun, 06 Sep 2026 17:47:59 GMT https://vulnogram.org/CVE-2026-19931 https://vulnogram.org/CVE-2026-19931 A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenti… Critical Network Exploitable Sun, 06 Sep 2026 17:47:43 GMT https://vulnogram.org/CVE-2026-18924 https://vulnogram.org/CVE-2026-18924 A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process. Critical Network Exploitable Sun, 06 Sep 2026 17:47:27 GMT https://vulnogram.org/CVE-2026-13608 https://vulnogram.org/CVE-2026-13608 A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or… High Network Exploitable Sun, 06 Sep 2026 17:47:01 GMT https://vulnogram.org/CVE-2026-9547 https://vulnogram.org/CVE-2026-9547 When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does… High Network Exploitable Fri, 03 Jul 2026 06:18:44 GMT https://vulnogram.org/CVE-2026-9546 https://vulnogram.org/CVE-2026-9546 A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a res… High Network Exploitable Fri, 03 Jul 2026 06:18:14 GMT https://vulnogram.org/CVE-2026-9545 https://vulnogram.org/CVE-2026-9545 In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to… High Network Exploitable Fri, 03 Jul 2026 06:17:55 GMT https://vulnogram.org/CVE-2026-9080 https://vulnogram.org/CVE-2026-9080 Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been fre… High Network Exploitable Fri, 03 Jul 2026 06:17:34 GMT https://vulnogram.org/CVE-2026-9079 https://vulnogram.org/CVE-2026-9079 libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. Critical Network Exploitable Fri, 03 Jul 2026 06:16:51 GMT https://vulnogram.org/CVE-2026-8932 https://vulnogram.org/CVE-2026-8932 libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one… High Network Exploitable Fri, 03 Jul 2026 06:16:30 GMT https://vulnogram.org/CVE-2026-8927 https://vulnogram.org/CVE-2026-8927 When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` us… Critical Network Exploitable Fri, 03 Jul 2026 06:16:06 GMT https://vulnogram.org/CVE-2026-8926 https://vulnogram.org/CVE-2026-8926 When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netr… Critical Network Exploitable Fri, 03 Jul 2026 06:15:45 GMT https://vulnogram.org/CVE-2026-8925 https://vulnogram.org/CVE-2026-8925 The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice. Critical Network Exploitable Fri, 03 Jul 2026 06:15:25 GMT https://vulnogram.org/CVE-2026-8924 https://vulnogram.org/CVE-2026-8924 A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelate… Critical Network Exploitable Fri, 03 Jul 2026 06:15:04 GMT https://vulnogram.org/CVE-2026-8458 https://vulnogram.org/CVE-2026-8458 libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an e… Medium Fri, 03 Jul 2026 06:14:42 GMT https://vulnogram.org/CVE-2026-8286 https://vulnogram.org/CVE-2026-8286 A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. High Fri, 03 Jul 2026 06:14:17 GMT https://vulnogram.org/CVE-2026-12064 https://vulnogram.org/CVE-2026-12064 When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of… High Network Exploitable Fri, 03 Jul 2026 06:13:55 GMT https://vulnogram.org/CVE-2026-11856 https://vulnogram.org/CVE-2026-11856 Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the… Critical Network Exploitable Fri, 03 Jul 2026 06:13:31 GMT https://vulnogram.org/CVE-2026-11586 https://vulnogram.org/CVE-2026-11586 By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messa… High Network Exploitable Fri, 03 Jul 2026 06:13:04 GMT https://vulnogram.org/CVE-2026-11564 https://vulnogram.org/CVE-2026-11564 libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the applic… Critical Network Exploitable Fri, 03 Jul 2026 06:12:35 GMT https://vulnogram.org/CVE-2026-11352 https://vulnogram.org/CVE-2026-11352 An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-c… High Network Exploitable Fri, 03 Jul 2026 06:12:10 GMT