Curl vulnerabilities
98 CVEs and advisories name Curl as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-3784wrong proxy connection reuse with credentials
- CVE-2026-3783token leak with redirect and netrc
- CVE-2026-1965bad reuse of HTTP Negotiate connection
- CVE-2025-11563wcurl path traversal with percent-encoded slashes
- CVE-2025-15224libssh key passphrase bypass without agent set
- CVE-2025-15079libssh global known_hosts override
- CVE-2025-14819OpenSSL partial chain store policy bypass
- CVE-2025-14524bearer token leak on cross-protocol redirect
- CVE-2025-14017broken TLS options for threaded LDAPS
- CVE-2025-13034No QUIC certificate pinning with GnuTLS
- CVE-2025-10966missing SFTP host verification with wolfSSH
- CVE-2025-10148predictable WebSocket mask
- CVE-2025-9086Out of bounds read for cookie path
- CVE-2025-5399WebSocket endless loop
- CVE-2025-5025No QUIC certificate pinning with wolfSSL
- CVE-2025-4947QUIC certificate check skip with wolfSSL
- CVE-2025-0725gzip integer overflow
- CVE-2025-0665eventfd double close
- CVE-2025-0167netrc and default credential leak
- CVE-2024-11053netrc and redirect credential leak
- CVE-2024-9681HSTS subdomain overwrites parent cache entry
- CVE-2024-8096OCSP stapling bypass with GnuTLS
- CVE-2024-7264ASN.1 date parser overread
- CVE-2024-6874macidn punycode buffer overread
- CVE-2024-6197freeing stack buffer in utf8asn1str
- CVE-2024-2466TLS certificate check bypass with mbedTLS
- CVE-2024-2379QUIC certificate check bypass with wolfSSL
- CVE-2024-2398HTTP/2 push headers memory-leak
- CVE-2024-2004Usage of disabled protocol
- CVE-2024-0853OCSP verification bypass with TLS session reuse