Haxx Curl

libcurl Credential Exposure via CURLINFO_EFFECTIVE_URL
CVE-2026-94266 - October 20, 2026

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

Curl HTTP Redirect Userinfo Leak: Kerberos Ticket Bypass
CVE-2026-94265 - October 20, 2026

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticketgenerated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`.

Stack Overflow in libcurl via Deeply Nested MIME Structure
CVE-2026-92391 - October 20, 2026

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.

curl anti-clobbering bypass via early hints (CVE-2026-92390)
CVE-2026-92390 - October 20, 2026

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.

libcurl TFTP State Machine Mis-Validation Enables Mixed-Mode TFTP Attack
CVE-2026-92389 - October 20, 2026

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.

libcurl FTP wildcard LIST leads to heap use-after-free & type confusion
CVE-2026-92388 - October 20, 2026

When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.

libcurl Timeout Bypass via Omitted Control-Response in FTP/IMAP/POP3/SMTP
CVE-2026-92387 - October 20, 2026

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

curl Cookie Jar Exceeded Length Vulnerability (CVE-2026-92386)
CVE-2026-92386 - October 20, 2026

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.

curl wSSL PKB bypass via forged cert validity
CVE-2026-87866 - October 20, 2026

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.

libcurl Host Key Validation Bug: Key Mismatch Treated as Missing Key
CVE-2026-87865 - October 20, 2026

When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.

CURL: HSTS max-age overflow truncates cache on 64-bit systems
CVE-2026-87863 - October 20, 2026

An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.

curl IMAP APPEND CRLF overflow allows command injection
CVE-2026-87864 - October 20, 2026

Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.

curl HSTS includeSubDomains parent entry drop causes HTTP downgrade
CVE-2026-87862 - October 20, 2026

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

libcurl Negotiate connection reuse miscredential per origin
CVE-2026-87861 - October 20, 2026

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.

libcurl Connection Cache Unintended Client Cert Leak on Redirect
CVE-2026-86415 - October 20, 2026

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.

HTTP Proxy Tricking libcurl into Credential Leakage via 401 WWW-Authenticate
CVE-2026-86414 - October 20, 2026

An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.

cURL Negotiate Auth Redirect Credential Leak
CVE-2026-86413 - October 20, 2026

When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.

Curl Cookie Jar Empty on Subsequent Calls via Malicious Server
CVE-2026-86412 - October 20, 2026

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.

libcurl: reused FTP control conn via session when CURLOPT_USE_SSL=NONE
CVE-2026-86411 - October 20, 2026

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

CURL Vulnerability: SSH Host Verification Ignored on Redirect (SFTP/SCP)
CVE-2026-86410 - October 20, 2026

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

libcurl SigV4 Auth Leakage via CURLOPT_AWS_SIGV4 NULL
CVE-2026-86409 - October 20, 2026

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.

Curl HTTP/2 RST_STREAM UAF during upload
CVE-2026-92392 8.1 - High - October 14, 2026

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

Dangling pointer

libcurl Cookie Domain Bypass via PSL Misinterpretation
CVE-2026-82209 8.2 - High - September 06, 2026

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).

Insertion of Sensitive Information Into Sent Data

libcurl wolfSSL CA Caching Bypass via CURLOPT_SSL_CTX_FUNCTION
CVE-2026-82208 7.5 - High - September 06, 2026

With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.

Improper Certificate Validation

curl Set-Cookie Tab Before Secure Flag Causes Unsecured Cookie Storage
CVE-2026-80255 7.5 - High - September 06, 2026

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Insertion of Sensitive Information Into Sent Data

libcurl HTTPS Connection Reuse with CURLSSLOPT_NATIVE_CA Misconfiguration
CVE-2026-80231 7.5 - High - September 06, 2026

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

Exposure of Data Element to Wrong Session

libcurl Public Key Pinning Bypassed when Peer Verification Disabled
CVE-2026-80230 7.5 - High - September 06, 2026

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

Improper Certificate Validation

libcurl UAF via Dangling TLS Context in OpenSSL 3 Multi Interface
CVE-2026-80229 7.5 - High - September 06, 2026

When performing transfers via libcurls multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

Dangling pointer

libcurl Negotiate Auth Reuse Allows CrossUser Credential Leakage
CVE-2026-19931 9.8 - Critical - September 06, 2026

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Exposure of Data Element to Wrong Session

libcurl HTTP/2 Server Push Use-After-Free via Connection Sharing
CVE-2026-18924 9.1 - Critical - September 06, 2026

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

Dangling pointer

libcurl LDAP SASL Handshake Bypass via MITM (CVE-2026-13608)
CVE-2026-13608 7.4 - High - September 06, 2026

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

Improper Restriction of Communication Channel to Intended Endpoints

libcurl SSH Key Type Mismatch Allows Silent MITM via CURLOPT_SSH_KEYFUNCTION
CVE-2026-9547 7.4 - High - July 03, 2026

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

Improper Validation of Certificate with Host Mismatch

libcurl : Referer Header Persists After NULL Clearing (CVE-2026-9546)
CVE-2026-9546 7.5 - High - July 03, 2026

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.

Information Disclosure

libcurl HTTP/3 session resumption EarlyData info leak
CVE-2026-9545 7.5 - High - July 03, 2026

In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.

Information Disclosure

libcurl UAF via curl_easy_pause() in SOCKETFUNCTION
CVE-2026-9080 7.3 - High - July 03, 2026

Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.

Dangling pointer

Privilege Esc Escalation: libcurl Fails to Clear Proxy Auth Credentials
CVE-2026-9079 9.8 - Critical - July 03, 2026

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Insufficiently Protected Credentials

libcurl mTLS cert mismatch causes insecure connection reuse
CVE-2026-8932 7.5 - High - July 03, 2026

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Authentication Bypass by Primary Weakness

libcurl: Proxy Auth Leakage on Reused Handles
CVE-2026-8927 9.1 - Critical - July 03, 2026

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

Authentication Bypass by Capture-replay

curl Credential Inference via .netrc/Username Mismatch
CVE-2026-8926 9.1 - Critical - July 03, 2026

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

Insufficiently Protected Credentials

cURL doublefree via GSASL context cleanup bug
CVE-2026-8925 9.8 - Critical - July 03, 2026

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

Double-free

Curl Cookie Parsing Vulnerability: Super Cookies Bypass PSL
CVE-2026-8924 9.1 - Critical - July 03, 2026

A flaw in curls cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Insertion of Sensitive Information Into Sent Data

libcurl Negotiate Authentication Connection Reuse Flaw
CVE-2026-8458 6.5 - Medium - July 03, 2026

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Exposure of Data Element to Wrong Session

CURL STARTTLS Connection Reuse with TLS Mismatch
CVE-2026-8286 8.1 - High - July 03, 2026

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

Improper Certificate Validation

cURL SSH Host Verification Bypass via Schemaless URL & --proto-default
CVE-2026-12064 7.5 - High - July 03, 2026

When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.

Improper Validation of Certificate with Host Mismatch

libcurl Header Leak: Digest Auth Reused Across Origins
CVE-2026-11856 9.8 - Critical - July 03, 2026

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.

Authentication Bypass by Capture-replay

curl Unbounded WebSocket PING Memory Exhaustion
CVE-2026-11586 7.5 - High - July 03, 2026

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.

Allocation of Resources Without Limits or Throttling

libcurl CA Trust Leakage via Persistent Connection Pool
CVE-2026-11564 9.1 - Critical - July 03, 2026

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Improper Certificate Validation

Curl QUIC HTTP/3 UDP DoS from Empty Datagram Abuse
CVE-2026-11352 7.5 - High - July 03, 2026

An issue in curls QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

Infinite Loop

Use-After-Free in libcurl during cleanup after stream-dependency reset
CVE-2026-10536 9.8 - Critical - July 03, 2026

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.

Dangling pointer

libcurl Proxy Digest Auth Header Leak on Handle Reuse
CVE-2026-7168 5.3 - Medium - May 13, 2026

Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.

Authentication Bypass by Capture-replay