Haxx Org behind the curl project, with curl lead developer Daniel Stenberg

By the Year

In 2026 there have been 67 vulnerabilities in Haxx with an average score of 7.3 out of ten. Last year, in 2025 Haxx had 9 security vulnerabilities published. That is, 58 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.51.

Recent Haxx Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-94266	Oct 20, 2026	libcurl Credential Exposure via CURLINFO_EFFECTIVE_URL libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.	Curl
CVE-2026-94265	Oct 20, 2026	Curl HTTP Redirect Userinfo Leak: Kerberos Ticket Bypass When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticketgenerated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`.	Curl
CVE-2026-92391	Oct 20, 2026	Stack Overflow in libcurl via Deeply Nested MIME Structure A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.	Curl
CVE-2026-92390	Oct 20, 2026	curl anti-clobbering bypass via early hints (CVE-2026-92390) When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.	Curl
CVE-2026-92389	Oct 20, 2026	libcurl TFTP State Machine Mis-Validation Enables Mixed-Mode TFTP Attack libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.	Curl
CVE-2026-92388	Oct 20, 2026	libcurl FTP wildcard LIST leads to heap use-after-free & type confusion When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.	Curl
CVE-2026-92387	Oct 20, 2026	libcurl Timeout Bypass via Omitted Control-Response in FTP/IMAP/POP3/SMTP By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.	Curl
CVE-2026-92386	Oct 20, 2026	curl Cookie Jar Exceeded Length Vulnerability (CVE-2026-92386) When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.	Curl
CVE-2026-87866	Oct 20, 2026	curl wSSL PKB bypass via forged cert validity When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.	Curl
CVE-2026-87865	Oct 20, 2026	libcurl Host Key Validation Bug: Key Mismatch Treated as Missing Key When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.	Curl