Curl vulnerabilities
98 CVEs and advisories name Curl as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-107929local interface connection reuse mixup
- CVE-2026-107928info leak uploading over WebSockets with GnuTLS
- CVE-2026-94266password leak in CURLINFO_EFFECTIVE_URL
- CVE-2026-94265Authorization: Negotiate sent to foreign origin
- CVE-2026-92391curl_mime_free stack overflow by recursion
- CVE-2026-92390-J no-clobber guarantee bypassed with 103 early hints
- CVE-2026-92389TFTP direction confusion
- CVE-2026-92388FTP wildcard write callback mixup
- CVE-2026-92387never-ending loop via server response omission
- CVE-2026-92386server-set cookie aborts cookie jar load
- CVE-2026-87866wolfSSL public-key pinning bypass
- CVE-2026-87865knownhost callback mismatches key as missing
- CVE-2026-87863HSTS response erases persisted entries
- CVE-2026-87864IMAP APPEND plus CRLF conversion command injection
- CVE-2026-87862HSTS cache import drops longer-lived child
- CVE-2026-87861cross-origin reuse of a Negotiate connection
- CVE-2026-86415auto client cert connection reuse mixup
- CVE-2026-86414leaking host credentials to HTTP proxy
- CVE-2026-86413Negotiate credentials sent to redirected origin
- CVE-2026-86412server-set cookie erases cookie jar
- CVE-2026-86411FTP connection reuse inherits client-certificate
- CVE-2026-86410redirect to SFTP or SCP bypasses host verification
- CVE-2026-86409stale SigV4 headers sent unintended
- CVE-2026-92392HTTP/2 upload Use-After-Free
- CVE-2026-82209domain-scoped PSL domain cookie
- CVE-2026-82208wolfSSL CA-cache hit overrides callback
- CVE-2026-80255secure cookie attribute bypass with tab
- CVE-2026-80231native CA store conn reuse
- CVE-2026-80230OpenSSL pinning bypass
- CVE-2026-80229OpenSSL provider use-after-free