Total
170 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-9547 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 7.4 HIGH |
| When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack. | |||||
| CVE-2026-9546 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 7.5 HIGH |
| A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers. | |||||
| CVE-2026-9545 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 7.5 HIGH |
| In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information. | |||||
| CVE-2026-9080 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 7.3 HIGH |
| Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed. | |||||
| CVE-2026-9079 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 9.8 CRITICAL |
| libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. | |||||
| CVE-2026-8932 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 7.5 HIGH |
| libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key. | |||||
| CVE-2026-8927 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 9.1 CRITICAL |
| When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`. | |||||
| CVE-2026-8926 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 9.1 CRITICAL |
| When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user. | |||||
| CVE-2026-8925 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 9.8 CRITICAL |
| The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice. | |||||
| CVE-2026-8924 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 9.1 CRITICAL |
| A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. | |||||
| CVE-2026-8458 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 6.5 MEDIUM |
| libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services. | |||||
| CVE-2026-8286 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 8.1 HIGH |
| A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. | |||||
| CVE-2026-82209 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 8.2 HIGH |
| When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`). | |||||
| CVE-2026-82208 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 7.5 HIGH |
| With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted. | |||||
| CVE-2026-80255 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 7.5 HIGH |
| A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host. | |||||
| CVE-2026-80231 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 7.5 HIGH |
| A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created. | |||||
| CVE-2026-80230 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 7.5 HIGH |
| When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected. | |||||
| CVE-2026-80229 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 7.5 HIGH |
| When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations. | |||||
| CVE-2026-7168 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 5.3 MEDIUM |
| Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`. | |||||
| CVE-2026-6429 | 1 Haxx | 1 Curl | 2026-09-15 | N/A | 5.3 MEDIUM |
| When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances. | |||||