CRITICAL9.8CVE-2026-9079libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials arou… >= 8.8.0, < 8.21.0-r0
CRITICAL9.8CVE-2026-8925The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in betwe… >= 8.15.0, < 8.21.0-r0
CRITICAL9.8CVE-2026-11856Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin… >= 7.10.6, < 8.21.0-r0
CRITICAL9.8curl - security update
from 0, < 8.4.0-r0
CRITICAL9.8curl - security update
from 0, < 7.80.0-r4
CRITICAL9.8When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a re…
>= 7.69.0, < 7.79.1-r2
CRITICAL9.8curl - security update
>= 7.12.3, < 7.59.0-r0
CRITICAL9.8curl - security update
>= 7.19.4, < 7.66.0-r0
CRITICAL9.8curl - security update
>= 7.52.0, < 7.66.0-r0
CRITICAL9.8libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow.
from 0, < 7.64.0-r0
CRITICAL9.8A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle.
>= 7.59.0, < 7.62.0-r0
CRITICAL9.8curl - security update
>= 7.33.0, < 7.62.0-r0
CRITICAL9.8curl - security update
from 0, < 7.61.1-r0
CRITICAL9.8The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled i…
from 0, < 7.51.0-r0
CRITICAL9.8The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
from 0, < 7.51.0-r0
CRITICAL9.8The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`.
from 0, < 7.51.0-r0
CRITICAL9.8The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` m…
from 0, < 7.51.0-r0
CRITICAL9.8Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable b…
>= 7.54.1, < 7.61.0-r0
CRITICAL9.8curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and…
>= 7.54.1, < 7.60.0-r0
CRITICAL9.8The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS b…
>= 7.30.0, < 7.52.1-r0
CRITICAL9.8curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash…
from 0, < 7.57.0-r0
CRITICAL9.8curl - security update
>= 7.21.0, < 7.57.0-r0
CRITICAL9.8curl - security update
from 0, < 7.57.0-r0
CRITICAL9.8curl - security update
from 0, < 7.50.3-r0
CRITICAL9.1When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy…
>= 7.12.0, < 8.21.0-r0
CRITICAL9.1When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like…
>= 8.11.1, < 8.21.0-r0
CRITICAL9.1A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check.
>= 7.46.0, < 8.21.0-r0
CRITICAL9.1libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.
>= 8.17.0, < 8.21.0-r0
CRITICAL9.1A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multi…
>= 7.77.0, < 7.79.1-r5
CRITICAL9.1When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already free…
from 0, < 7.79.0-r0
CRITICAL9.1Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in…
>= 7.14.1, < 7.62.0-r0
CRITICAL9.1curl - security update
>= 7.20.0, < 7.60.0-r0
CRITICAL9.1A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a deni…
>= 7.20.0, < 7.59.0-r0
CRITICAL9.1libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers.
from 0, < 7.58.0-r0
CRITICAL9.1curl - security update
from 0, < 7.56.1-r0
HIGH8.8curl - security update
>= 7.18.0, < 8.0.1-r0
HIGH8.8curl - security update
>= 7.0.0, < 8.0.1-r0
HIGH8.6When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maxim…
>= 7.44.0, < 8.7.1-r0
HIGH8.1A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even thoug…
>= 7.30.0, < 8.21.0-r0
HIGH8.1curl before 7.86.0 has a double free.
>= 7.77.0, < 7.80.0-r4
HIGH8.1A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--r…
from 0, < 7.83.1-r0
HIGH8.1An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connect…
>= 7.33.0, < 7.79.1-r1
HIGH8.1curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session…
>= 7.75.0, < 7.77.0-r0
HIGH8.1curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.
from 0, < 7.52.1-r0
HIGH8.1curl - security update
from 0, < 7.52.1-r0
HIGH8.1The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS b…
>= 7.30.0, < 7.52.1-r0
HIGH8.1Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified oth…
from 0, < 7.50.1-r0
HIGH7.8curl - security update
>= 7.20.0, < 7.66.0-r1
HIGH7.8curl - security update
from 0, < 7.65.0-r0
HIGH7.5A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared.
>= 8.18.0, < 8.21.0-r0
HIGH7.5In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site…
>= 8.11.0, < 8.21.0-r0
HIGH7.5libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited…
>= 7.7, < 8.21.0-r0
HIGH7.5By default, curl automatically responds to WebSocket PING frames.
>= 8.16.0, < 8.21.0-r0
HIGH7.5An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcu…
>= 8.18.0, < 8.21.0-r0
HIGH7.5Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy…
>= 7.71.0, < 8.20.0-r0
HIGH7.5libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.
>= 7.40.0, < 8.20.0-r0
HIGH7.5curl - security update
>= 8.13.0, < 8.14.1-r2
HIGH7.5Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in…
>= 8.13.0, < 8.14.1-r0
HIGH7.5libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string.
from 0, < 8.9.0-r0
HIGH7.5When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.
>= 7.84.0, < 8.3.0-r0
HIGH7.5A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA…
from 0, < 8.1.0-r0
HIGH7.5A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP.
>= 7.77.0, < 7.79.1-r4
HIGH7.5In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP.
>= 7.77.0, < 7.80.0-r4
HIGH7.5libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse…
from 0, < 7.79.1-r2
HIGH7.5libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Du…
from 0, < 7.79.1-r2
HIGH7.5The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *differen…
>= 7.80.0, < 7.80.0-r2
HIGH7.5An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connec…
>= 7.65.0, < 7.79.1-r1
HIGH7.5curl - security update
>= 7.20.0, < 7.79.0-r0
HIGH7.5libcurl-using applications can ask for a specific client certificate to be used in a transfer.
>= 7.33.0, < 7.67.0-r5
HIGH7.5curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP respo…
from 0, < 7.66.0-r3
HIGH7.5curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
from 0, < 7.66.0-r3
HIGH7.5curl - security update
from 0, < 7.66.0-r2
HIGH7.5curl - security update
>= 7.62.0, < 7.66.0-r1
HIGH7.5libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP.
from 0, < 7.64.0-r0
HIGH7.5curl - security update
from 0, < 7.64.0-r0
HIGH7.5curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and…
from 0, < 7.51.0-r0
HIGH7.5A flaw was found in curl before version 7.51.0.
from 0, < 7.51.0-r0
HIGH7.5curl - security update
from 0, < 7.51.0-r0
HIGH7.5The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit sho…
from 0, < 7.51.0-r0
HIGH7.5curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, an…
from 0, < 7.51.0-r0
HIGH7.5In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had change…
from 0, < 7.54.0-r0
HIGH7.5A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of…
>= 7.21.0, < 7.59.0-r0
HIGH7.5curl - security update
from 0, < 7.55.0-r1
HIGH7.5curl - security update
from 0, < 7.50.2-r0
HIGH7.5curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote atta…
from 0, < 7.50.1-r0
HIGH7.5curl - security update
from 0, < 7.50.1-r0
HIGH7.3Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcur…
>= 8.13.0, < 8.21.0-r0
HIGH7.3When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,…
>= 7.10.5, < 8.12.0-r0
HIGH7.0libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded…
from 0, < 8.12.0-r0
HIGH7.0The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at leas…
from 0, < 7.51.0-r0
MEDIUM6.5libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use…
>= 7.46.0, < 8.21.0-r0
MEDIUM6.5libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenti…
>= 7.10.6, < 8.14.1-r3
MEDIUM6.5libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the UR…
>= 8.8.0, < 8.14.0-r0
MEDIUM6.5When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or late…
>= 7.74.0, < 8.11.0-r0
MEDIUM6.5curl - security update
>= 7.41.0, < 8.10.0-r0
MEDIUM6.5libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field.
from 0, < 8.9.1-r0
MEDIUM6.5libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.
>= 8.5.0, < 8.7.1-r0
MEDIUM6.5curl - security update
>= 7.46.0, < 8.5.0-r0
MEDIUM6.5curl - security update
>= 7.57.0, < 7.79.1-r5
MEDIUM6.5A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incor…
>= 7.77.0, < 7.79.1-r5