openRuyi Lookout
← Packages

curl

autotoolsAdvisory 9

A Tool for Transferring Data from URLs

Current
8.21.0
Candidate
8.23.0
License
curl

Build

TargetResultLast successful versionSucceeded at
rva23
8.21.0
rva20
8.21.0
x86_64
8.21.0

Advisory · 9

Query product
curlNVD
Query vendor
haxxNVD
Query version
8.21.0NVD

Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.

  • CVE-2026-13608
    NVD
    Summary
    A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.NVD
    EPSS model date
    2026-11-04FIRST
    EPSS probability
    0.5%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*; >= 7.82.0, < 8.22.0NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NNVD
  • CVE-2026-18924
    NVD
    Summary
    A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.NVD
    EPSS model date
    2026-11-04FIRST
    EPSS probability
    0.584%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*; >= 7.44.0, < 8.22.0NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HNVD
  • CVE-2026-19931
    NVD
    Summary
    A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.NVD
    EPSS model date
    2026-11-04FIRST
    EPSS probability
    0.747%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*; >= 7.64.1, < 8.22.0NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
  • CVE-2026-80229
    NVD
    Summary
    When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.NVD
    EPSS model date
    2026-11-04FIRST
    EPSS probability
    0.563%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*; >= 8.14.0, < 8.22.0NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
  • CVE-2026-80230
    NVD
    Summary
    When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.NVD
    EPSS model date
    2026-11-04FIRST
    EPSS probability
    0.371%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*; >= 7.45.0, < 8.22.0NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
  • CVE-2026-80231
    NVD
    Summary
    A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.NVD
    EPSS model date
    2026-11-04FIRST
    EPSS probability
    0.898%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*; >= 7.71.0, < 8.22.0NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
  • CVE-2026-80255
    NVD
    Summary
    A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.NVD
    EPSS model date
    2026-11-04FIRST
    EPSS probability
    0.478%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*; >= 8.13.0, < 8.22.0NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD
  • CVE-2026-82208
    NVD
    Summary
    With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.NVD
    EPSS model date
    2026-11-04FIRST
    EPSS probability
    0.407%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*; >= 8.9.1, < 8.22.0NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD
  • CVE-2026-82209
    NVD
    Summary
    When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).NVD
    EPSS model date
    2026-11-04FIRST
    EPSS probability
    0.373%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*; >= 7.46.0, < 8.22.0NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NNVD

Description

Curl is a client to get documents and files from or send documents to a server using any of the supported protocols (HTTP, HTTPS, FTP, FTPS, TFTP, DICT, TELNET, LDAP, or FILE). The command is designed to work without user interaction or any kind of interactivity.

Changelog

PR · 4

Issue · 2

Checks
MonitorObservationLast checked
Source
Checked
Version
Checked
Build
Checked
GitHub
Checked
EOL
Not configured
No reliable monitor identity/configuration.
—
LicenseDiff
Not configured
No reliable monitor identity/configuration.
—
Dependencies
Not configured
No reliable monitor identity/configuration.
—
Advisory
Checked
Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated.
Last attempted
Yanked
Not configured
No reliable monitor identity/configuration.
—