Export limit exceeded: 425803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 209

Export CSV
CVE-2026-9080

UAF after pause in socket callback

Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-8286

wrong STARTTLS connection reuse

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-9079

stale proxy password leak

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-7168

cross-proxy Digest auth state leak

Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Curl Haxx Redhat
Products
Curl Curl Hummingbird
CVE-2026-3784

wrong proxy connection reuse with credentials

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2025-10966

missing SFTP host verification with wolfSSH

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-7009

OCSP stapling bypass with Apple SecTrust

When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-6276

stale custom cookie host causes cookie leak

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Libcurl Curl
CVE-2026-4873

connection reuse ignores TLS requirement

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-6253

proxy credentials leak over redirect-to proxy

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2023-46219

curl: excessively long file name may lead to unknown HSTS status

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Haxx Redhat
Products
Fedora Curl Jboss Core Services
CVE-2023-46218

curl: information disclosure by exploiting a mixed case flaw

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Fedoraproject Haxx Redhat
Products
Fedora Curl Enterprise Linux and 4 more
CVE-2023-38546

curl: cookie injection with none file

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

CVSS 3.1 · 3.7 Low EPSS 6.0% KEV · Not listed
Vendors
Haxx Redhat
Products
Libcurl Enterprise Linux Jboss Core Services and 3 more
CVE-2023-38545

curl: heap based buffer overflow in the SOCKS5 proxy handshake

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.

CVSS 3.1 · 8.8 High EPSS 78.3% KEV · Not listed
Vendors
Fedoraproject Haxx Microsoft and 2 more
Products
Fedora Libcurl Windows 10 1809 and 16 more
CVE-2017-7407

curl: --write-out out of bounds read

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2017-1000101

curl: URL globbing out of bounds read

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2017-1000100

curl: TFTP sends more than buffer size

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.

CVSS 3.1 · 6.5 Medium EPSS 4.0% KEV · Not listed
Vendors
Haxx Redhat
Products
Libcurl Rhel Software Collections
CVE-2018-16840

curl: Use-after-free when closing "easy" handle in Curl_close()

A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

CVSS 3.1 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Canonical Haxx Redhat
Products
Ubuntu Linux Curl Jboss Core Services
CVE-2016-8624

curl: Invalid URL parsing with '#'

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

CVSS 3.0 · 5.3 Medium EPSS 6.3% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections