curl vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-92392 During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after freeHigh 8.1 · Oct 14, 2026
• CVE-2026-82209 When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attributHigh 8.2 · Sep 6, 2026
• CVE-2026-82208 With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cacHigh 7.5 · Sep 6, 2026
• CVE-2026-80255 A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store High 7.5 · Sep 6, 2026
• CVE-2026-80231 A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPHigh 7.5 · Sep 6, 2026
• CVE-2026-80230 When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOSTHigh 7.5 · Sep 6, 2026
• CVE-2026-80229 When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles.High 7.5 · Sep 6, 2026
• CVE-2026-19931 A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using emCritical 9.8 · Sep 6, 2026
• CVE-2026-18924 A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free inCritical 9.1 · Sep 6, 2026
• CVE-2026-13608 A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verifiHigh 7.4 · Sep 6, 2026
• CVE-2026-9547 When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untHigh 7.4 · Jul 3, 2026
• CVE-2026-9546 A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared.High 7.5 · Jul 3, 2026
• CVE-2026-9545 In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replacedHigh 7.5 · Jul 3, 2026
• CVE-2026-9080 Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store aHigh 7.3 · Jul 3, 2026
• CVE-2026-9079 libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for suCritical 9.8 · Jul 3, 2026
• CVE-2026-8932 libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.High 7.5 · Jul 3, 2026
• CVE-2026-8927 When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication stateCritical 9.1 · Jul 3, 2026
• CVE-2026-8926 When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@exampCritical 9.1 · Jul 3, 2026
• CVE-2026-8925 The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()Critical 9.8 · Jul 3, 2026
• CVE-2026-8924 A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check.Critical 9.1 · Jul 3, 2026
• CVE-2026-8286 A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuratiHigh 8.1 · Jul 3, 2026
• CVE-2026-12064 When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl.High 7.5 · Jul 3, 2026
• CVE-2026-11856 Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (Critical 9.8 · Jul 3, 2026
• CVE-2026-11586 By default, curl automatically responds to WebSocket PING frames.High 7.5 · Jul 3, 2026
• CVE-2026-11564 libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.Critical 9.1 · Jul 3, 2026