| CVE-2026-9547 |
|
High |
Jul 03, 2026 |
When a libcurl-based application performs transfers via `SCP://` or `SFTP://`
and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently acce
more...
When a libcurl-based application performs transfers via `SCP://` or `SFTP://`
and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an
untrusted server. This vulnerability occurs when a server presents a host key
type that does not match the specific key type already recorded for that host
in the `known_hosts` file. Instead of rejecting the mismatch, the callback
mechanism fails to properly enforce the restriction, allowing the connection
to succeed without warning and risking a potential man-in-the-middle attack.
less...
|
8.20.0, 8.19.0, 8.16.0, 8.14.1, 8.12.0, 8.10.0, 8.8.0, 8.6.0, 8.3.0, 8.2.0
|
| CVE-2026-9546 |
|
High |
Jul 03, 2026 |
A vulnerability in libcurl caused the HTTP `Referer:` header to persist even
when explicitly cleared. While the documentation states that passing NULL
more...
A vulnerability in libcurl caused the HTTP `Referer:` header to persist even
when explicitly cleared. While the documentation states that passing NULL to
`CURLOPT_REFERER` suppresses the header, the option failed to clear the
internal state. As a result the previous referrer string was erroneously
reused and sent in subsequent requests, potentially leaking sensitive
information to unintended servers.
less...
|
8.20.0, 8.19.0
|
| CVE-2026-9545 |
|
High |
Jul 03, 2026 |
In this scenario, libcurl first uses a proper HTTP/3 server for the initial
transfers, and when it makes a second transfer to the same site it has been
more...
In this scenario, libcurl first uses a proper HTTP/3 server for the initial
transfers, and when it makes a second transfer to the same site it has been
replaced by the attacker's impostor machine - without a valid certificate.
When libcurl returns to the hostname the second time with a cached SSL session
(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the
`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might
send off the second request's bytes on that new connection *before* enforcing
the certificate verification failure. Potentially leaking sensitive
information.
less...
|
8.20.0, 8.19.0, 8.16.0, 8.14.1, 8.12.0
|
| CVE-2026-9080 |
|
High |
Jul 03, 2026 |
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`
callback triggers a use-after-free vulnerability, where libcurl attempts t
more...
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`
callback triggers a use-after-free vulnerability, where libcurl attempts to
store a flag using a dangling struct pointer immediately after that pointer's
memory has been freed.
less...
|
8.20.0, 8.19.0, 8.16.0, 8.14.1
|
| CVE-2026-9079 |
|
Critical |
Jul 03, 2026 |
libcurl had a flaw that when instructed to clear proxy authentication
credentials which made it not do so, leaving the old credentials around to get
us
more...
libcurl had a flaw that when instructed to clear proxy authentication
credentials which made it not do so, leaving the old credentials around to get
used for subsequent transfers that should not know nor use them.
less...
|
8.20.0, 8.19.0, 8.16.0, 8.14.1, 8.12.0, 8.10.0, 8.8.0
|
| CVE-2026-8932 |
|
High |
Jul 03, 2026 |
libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.
libc
more...
libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.
libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup. However, some TLS
settings related to client certificates were left out from the configuration
match checks, making them match too easily. In particular options related to
the private key.
less...
|
8.20.0, 8.19.0, 8.16.0, 8.14.1, 8.12.0, 8.10.0, 8.8.0, 8.6.0, 8.3.0, 8.2.0
|
| CVE-2026-8927 |
|
Critical |
Jul 03, 2026 |
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authenticat
more...
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
less...
|
8.20.0, 8.19.0, 8.16.0, 8.14.1, 8.12.0, 8.10.0, 8.8.0, 8.6.0, 8.3.0, 8.2.0
|
| CVE-2026-8926 |
|
Critical |
Jul 03, 2026 |
When asking curl to use a `.netrc` file to find credentials and at the same
time specifying a URL with a username(without a password), like
`https://us
more...
When asking curl to use a `.netrc` file to find credentials and at the same
time specifying a URL with a username(without a password), like
`https://[email protected]/`, curl could wrongly get and use the password for
*another* user set in the `.netrc` file for that host if such a one exists and
there is no match for the specified user.
less...
|
8.20.0, 8.19.0, 8.16.0, 8.14.1, 8.12.0
|
| CVE-2026-8925 |
|
Critical |
Jul 03, 2026 |
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context *twice* without clearing the pointer in between, making i
more...
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context *twice* without clearing the pointer in between, making it
`free()` the same pointer twice.
less...
|
8.20.0, 8.19.0, 8.16.0
|
| CVE-2026-8924 |
|
Critical |
Jul 03, 2026 |
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
'super cookies' that bypass the Public Suffix List check. This enables an
a
more...
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
'super cookies' that bypass the Public Suffix List check. This enables an
attacker-controlled origin to inject cookies that curl subsequently scopes and
transmits to unrelated third-party domains.
less...
|
8.20.0, 8.19.0, 8.16.0, 8.14.1, 8.12.0, 8.10.0, 8.8.0, 8.6.0, 8.3.0, 8.2.0
|
