PatchTheCEVCVEs published by curl
CVEs published by curl (CVE Numbering Authority). 23 tracked.
- CVE-2026-86409 HIGH n/a Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and do
- CVE-2026-86413 HIGH n/a When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects,
- CVE-2026-92387 HIGH n/a By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can explo
- CVE-2026-94265 HIGH n/a When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might er
- CVE-2026-86410 HIGH n/a A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting
- CVE-2026-86412 HIGH n/a A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload
- CVE-2026-107929 HIGH n/a When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented p
- CVE-2026-87861 HIGH n/a When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connectio
- CVE-2026-87862 HIGH n/a Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child
- CVE-2026-87863 HIGH n/a An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serializati
- CVE-2026-92386 HIGH n/a When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write
- CVE-2026-92390 HIGH n/a When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protect
- CVE-2026-92391 HIGH n/a A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl dur
- CVE-2026-87864 HIGH n/a Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal whi
- CVE-2026-87866 HIGH n/a When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer do
- CVE-2026-86411 HIGH n/a An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previo
- CVE-2026-86414 HIGH n/a An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos
- CVE-2026-87865 HIGH n/a When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key vali
- CVE-2026-92388 HIGH n/a When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings,
- CVE-2026-92389 HIGH n/a libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, acc
- CVE-2026-94266 HIGH n/a libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing
- CVE-2026-107928 HIGH n/a When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer
- CVE-2026-86415 HIGH n/a libcurl's connection cache match function never considers the automatic client certificate option, so a cached