Curl vulnerabilities
98 CVEs and advisories name Curl as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-19931Negotiate ambient user conn reuse
- CVE-2026-18924HTTP/2 server push UAF
- CVE-2026-13608OpenLDAP SASL authentication bypass
- CVE-2026-9547SSH improper host validation
- CVE-2026-9546sending old referer
- CVE-2026-9545exposing HTTP/3 early data
- CVE-2026-9080UAF after pause in socket callback
- CVE-2026-9079stale proxy password leak
- CVE-2026-8932incomplete mTLS config matching in conn reuse
- CVE-2026-8927env-set cross-proxy Digest auth state leak
- CVE-2026-8926password leak with netrc and user in URL
- CVE-2026-8925SASL double-free
- CVE-2026-8924trailing dot domain super cookie
- CVE-2026-8458wrong reuse for different services
- CVE-2026-8286wrong STARTTLS connection reuse
- CVE-2026-12064proto-default skips SSH verification
- CVE-2026-11856cross-origin Digest auth state leak
- CVE-2026-11586WS Auto-PONG memory exhaustion
- CVE-2026-11564Native CA trust persist
- CVE-2026-11352QUIC zero-length UDP datagrams busy-loop
- CVE-2026-10536HTTP/2 stream-dependency tree UAF
- CVE-2026-7168cross-proxy Digest auth state leak
- CVE-2026-7009OCSP stapling bypass with Apple SecTrust
- CVE-2026-6429netrc credential leak with reused proxy connection
- CVE-2026-6276stale custom cookie host causes cookie leak
- CVE-2026-6253proxy credentials leak over redirect-to proxy
- CVE-2026-5773wrong reuse of SMB connection
- CVE-2026-5545wrong reuse of HTTP Negotiate connection
- CVE-2026-4873connection reuse ignores TLS requirement
- CVE-2026-3805use after free in SMB connection reuse