Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 209

Export CSV
CVE-2019-5443

curl: Windows OpenSSL engine code injection

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Haxx Microsoft Netapp and 1 more
Products
Curl Windows Oncommand Insight and 7 more
CVE-2019-5435

curl: Integer overflows in curl_url_set() function

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.

CVSS 3.0 · 3.7 Low EPSS 5.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services
CVE-2011-3389

HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

CVSS 2.0 · 4.3 Medium EPSS 73.3% KEV · Not listed
Vendors
Canonical Debian Google and 6 more
Products
Ubuntu Linux Debian Linux Chrome and 18 more
CVE-2026-82209

domain-scoped PSL domain cookie

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-82208

wolfSSL CA-cache hit overrides callback

With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-80255

secure cookie attribute bypass with tab

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-80231

native CA store conn reuse

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx Redhat
Products
Curl Curl Hummingbird
CVE-2026-80230

OpenSSL pinning bypass

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx Redhat
Products
Curl Curl Hummingbird
CVE-2026-19931

Negotiate ambient user conn reuse

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-18924

HTTP/2 server push UAF

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-13608

OpenLDAP SASL authentication bypass

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-9547

SSH improper host validation

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-9546

sending old referer

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-9545

exposing HTTP/3 early data

In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-8932

incomplete mTLS config matching in conn reuse

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-8926

password leak with netrc and user in URL

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-8924

trailing dot domain super cookie

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl