Haxx Org behind the curl project, with curl lead developer Daniel Stenberg

By the Year

In 2026 there have been 45 vulnerabilities in Haxx with an average score of 7.3 out of ten. Last year, in 2025 Haxx had 9 security vulnerabilities published. That is, 36 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.27.

Recent Haxx Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-82209	Sep 06, 2026	libcurl Cookie Domain Bypass via PSL Misinterpretation When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).	Curl
CVE-2026-82208	Sep 06, 2026	libcurl wolfSSL CA Caching Bypass via CURLOPT_SSL_CTX_FUNCTION With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.	Curl
CVE-2026-80255	Sep 06, 2026	curl Set-Cookie Tab Before Secure Flag Causes Unsecured Cookie Storage A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.	Curl
CVE-2026-80231	Sep 06, 2026	libcurl HTTPS Connection Reuse with CURLSSLOPT_NATIVE_CA Misconfiguration A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.	Curl
CVE-2026-80230	Sep 06, 2026	libcurl Public Key Pinning Bypassed when Peer Verification Disabled When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.	Curl
CVE-2026-80229	Sep 06, 2026	libcurl UAF via Dangling TLS Context in OpenSSL 3 Multi Interface When performing transfers via libcurls multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.	Curl
CVE-2026-19931	Sep 06, 2026	libcurl Negotiate Auth Reuse Allows CrossUser Credential Leakage A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.	Curl
CVE-2026-18924	Sep 06, 2026	libcurl HTTP/2 Server Push Use-After-Free via Connection Sharing A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.	Curl
CVE-2026-13608	Sep 06, 2026	libcurl LDAP SASL Handshake Bypass via MITM (CVE-2026-13608) A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.	Curl
CVE-2026-9547	Jul 03, 2026	libcurl SSH Key Type Mismatch Allows Silent MITM via CURLOPT_SSH_KEYFUNCTION When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.	Curl