CVE-2026-10536

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10536", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-06-01T11:49:55.548Z", "datePublished": "2026-07-03T06:11:15.378Z", "dateUpdated": "2026-09-15T06:02:36.781Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:36.781Z"}, "title": "HTTP/2 stream-dependency tree UAF", "descriptions": [{"lang": "en", "value": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "7.88.0", "status": "affected", "versionType": "semver", "lessThan": "8.14.2"}, {"version": "8.15.0", "status": "affected", "versionType": "semver", "lessThan": "8.16.1"}, {"version": "8.17.0", "status": "affected", "versionType": "semver", "lessThan": "8.20.1"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "71b7e0161032927cdfb4e75ea40f65b8898b3956", "status": "affected", "versionType": "git", "lessThan": "bfbff7852f050232edd3e5ca5c6bf2021c340f5a"}], "defaultStatus": "unaffected", "repo": "https://github.com/curl/curl.git"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8.20.0", "status": "affected"}, {"version": "8.19.0", "status": "affected"}, {"version": "8.18.0", "status": "affected"}, {"version": "8.17.0", "status": "affected"}, {"version": "8.16.0", "status": "affected"}, {"version": "8.15.0", "status": "affected"}, {"version": "8.14.1", "status": "affected"}, {"version": "8.14.0", "status": "affected"}, {"version": "8.13.0", "status": "affected"}, {"version": "8.12.1", "status": "affected"}, {"version": "8.12.0", "status": "affected"}, {"version": "8.11.1", "status": "affected"}, {"version": "8.11.0", "status": "affected"}, {"version": "8.10.1", "status": "affected"}, {"version": "8.10.0", "status": "affected"}, {"version": "8.9.1", "status": "affected"}, {"version": "8.9.0", "status": "affected"}, {"version": "8.8.0", "status": "affected"}, {"version": "8.7.1", "status": "affected"}, {"version": "8.7.0", "status": "affected"}, {"version": "8.6.0", "status": "affected"}, {"version": "8.5.0", "status": "affected"}, {"version": "8.4.0", "status": "affected"}, {"version": "8.3.0", "status": "affected"}, {"version": "8.2.1", "status": "affected"}, {"version": "8.2.0", "status": "affected"}, {"version": "8.1.2", "status": "affected"}, {"version": "8.1.1", "status": "affected"}, {"version": "8.1.0", "status": "affected"}, {"version": "8.0.1", "status": "affected"}, {"version": "8.0.0", "status": "affected"}, {"version": "7.88.1", "status": "affected"}, {"version": "7.88.0", "status": "affected"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-10536.json"}, {"url": "https://curl.se/docs/CVE-2026-10536.html"}, {"url": "https://hackerone.com/reports/3751697"}], "x_osv": {"schema_version": "1.5.0", "id": "CURL-CVE-2026-10536", "aliases": ["CVE-2026-10536"], "summary": "HTTP/2 stream-dependency tree UAF", "modified": "2026-09-07T10:34:51.00Z", "database_specific": {"package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2026-10536.json", "www": "https://curl.se/docs/CVE-2026-10536.html", "issue": "https://hackerone.com/reports/3751697", "CWE": {"id": "CWE-416", "desc": "Use After Free"}, "last_affected": "8.20.0", "severity": "Low"}, "published": "2026-06-24T08:00:00.00Z", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "7.88.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}]}, {"type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [{"introduced": "71b7e0161032927cdfb4e75ea40f65b8898b3956"}, {"fixed": "bfbff7852f050232edd3e5ca5c6bf2021c340f5a"}]}], "versions": ["8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0"]}], "credits": [{"name": "Joshua Rogers (Aisle Research)", "type": "finder"}, {"name": "Stefan Eissing", "type": "remediation developer"}], "details": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use After Free", "cweId": "CWE-416", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Joshua Rogers (Aisle Research)", "type": "finder"}, {"lang": "en", "value": "Stefan Eissing", "type": "remediation developer"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://hackerone.com/reports/3751697", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T18:28:36.822614Z", "id": "CVE-2026-10536", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T18:29:27.171Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-10536", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T18:28:36.822614Z"}}}], "references": [{"url": "https://hackerone.com/reports/3751697", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T18:29:23.421Z"}}], "cna": {"title": "HTTP/2 stream-dependency tree UAF", "x_osv": {"id": "CURL-CVE-2026-10536", "aliases": ["CVE-2026-10536"], "credits": [{"name": "Joshua Rogers (Aisle Research)", "type": "finder"}, {"name": "Stefan Eissing", "type": "remediation developer"}], "details": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.", "summary": "HTTP/2 stream-dependency tree UAF", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "7.88.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}]}, {"repo": "https://github.com/curl/curl.git", "type": "GIT", "events": [{"introduced": "71b7e0161032927cdfb4e75ea40f65b8898b3956"}, {"fixed": "bfbff7852f050232edd3e5ca5c6bf2021c340f5a"}]}], "versions": ["8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0"]}], "modified": "2026-09-07T10:34:51.00Z", "published": "2026-06-24T08:00:00.00Z", "schema_version": "1.5.0", "database_specific": {"CWE": {"id": "CWE-416", "desc": "Use After Free"}, "URL": "https://curl.se/docs/CVE-2026-10536.json", "www": "https://curl.se/docs/CVE-2026-10536.html", "issue": "https://hackerone.com/reports/3751697", "affects": "lib", "package": "curl", "severity": "Low", "last_affected": "8.20.0"}}, "credits": [{"lang": "en", "type": "finder", "value": "Joshua Rogers (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Stefan Eissing"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "7.88.0", "lessThan": "8.14.2", "versionType": "semver"}, {"status": "affected", "version": "8.15.0", "lessThan": "8.16.1", "versionType": "semver"}, {"status": "affected", "version": "8.17.0", "lessThan": "8.20.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "71b7e0161032927cdfb4e75ea40f65b8898b3956", "lessThan": "bfbff7852f050232edd3e5ca5c6bf2021c340f5a", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}, {"status": "affected", "version": "8.10.1"}, {"status": "affected", "version": "8.10.0"}, {"status": "affected", "version": "8.9.1"}, {"status": "affected", "version": "8.9.0"}, {"status": "affected", "version": "8.8.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.6.0"}, {"status": "affected", "version": "8.5.0"}, {"status": "affected", "version": "8.4.0"}, {"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.2.1"}, {"status": "affected", "version": "8.2.0"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.0.1"}, {"status": "affected", "version": "8.0.0"}, {"status": "affected", "version": "7.88.1"}, {"status": "affected", "version": "7.88.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-10536.json"}, {"url": "https://curl.se/docs/CVE-2026-10536.html"}, {"url": "https://hackerone.com/reports/3751697"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "Use After Free"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:36.781Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10536", "state": "PUBLISHED", "dateUpdated": "2026-09-15T06:02:36.781Z", "dateReserved": "2026-06-01T11:49:55.548Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2026-07-03T06:11:15.378Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThan": "8.14.2", "status": "affected", "version": "7.88.0", "versionType": "semver"}, {"lessThan": "8.16.1", "status": "affected", "version": "8.15.0", "versionType": "semver"}, {"lessThan": "8.20.1", "status": "affected", "version": "8.17.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "curl", "repo": "https://github.com/curl/curl.git", "vendor": "curl", "versions": [{"lessThan": "bfbff7852f050232edd3e5ca5c6bf2021c340f5a", "status": "affected", "version": "71b7e0161032927cdfb4e75ea40f65b8898b3956", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}, {"status": "affected", "version": "8.10.1"}, {"status": "affected", "version": "8.10.0"}, {"status": "affected", "version": "8.9.1"}, {"status": "affected", "version": "8.9.0"}, {"status": "affected", "version": "8.8.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.6.0"}, {"status": "affected", "version": "8.5.0"}, {"status": "affected", "version": "8.4.0"}, {"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.2.1"}, {"status": "affected", "version": "8.2.0"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.0.1"}, {"status": "affected", "version": "8.0.0"}, {"status": "affected", "version": "7.88.1"}, {"status": "affected", "version": "7.88.0"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "matchCriteriaId": "1088DD7B-0C10-4992-83C7-66931BB8F297", "versionEndExcluding": "8.21.0", "versionStartIncluding": "7.88.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."}], "id": "CVE-2026-10536", "lastModified": "2026-09-15T07:16:25.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10536", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T18:28:36.822614Z", "version": "2.0.3"}}]}, "published": "2026-07-03T07:16:23.563", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Patch", "Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-10536.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-10536.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3751697"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3751697"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service", "id": "2496766", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496766"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.", "A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving `curl_easy_reset()` and `curl_easy_cleanup()`. During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-10536", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Affected", "package_name": "libcurl-1.dll", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Affected", "package_name": "libcurl.so", "product_name": "Red Hat JBoss Core Services"}], "public_date": "2026-07-03T06:11:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-10536\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-10536\nhttps://curl.se/docs/CVE-2026-10536.html\nhttps://curl.se/docs/CVE-2026-10536.json\nhttps://hackerone.com/reports/3751697"], "statement": "This Moderate impact use-after-free flaw in libcurl can lead to application crashes and Denial of Service. It occurs when an application specifically configures an HTTP/2 stream-dependency tree and then performs a precise sequence of `curl_easy_reset()` and `curl_easy_cleanup()` operations, attempting to access already freed memory. This vulnerability requires a specific application programming pattern, limiting its exploitability in typical Red Hat deployments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.20.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.19.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.18.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.17.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.16.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.15.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.14.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.14.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.13.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.12.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.12.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.11.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.11.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.10.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.10.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.9.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.9.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.8.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.7.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.7.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.6.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.5.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.4.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.3.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.2.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.2.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.1.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.1.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.88.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.88.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "curl", "source": "cna", "vendor": "curl"}, "product": "curl", "vendor": "curl"}], "created": "2026-07-03T08:15:06.572746+00:00", "updated": "2026-08-12T00:30:03.116960+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}