CVE-2026-13608

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13608", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-06-29T08:57:44.945Z", "datePublished": "2026-09-06T17:47:01.951Z", "dateUpdated": "2026-09-15T06:02:45.788Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:45.788Z"}, "title": "OpenLDAP SASL authentication bypass", "descriptions": [{"lang": "en", "value": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "7.82.0", "status": "affected", "versionType": "semver", "lessThan": "8.14.2"}, {"version": "8.15.0", "status": "affected", "versionType": "semver", "lessThan": "8.16.1"}, {"version": "8.17.0", "status": "affected", "versionType": "semver", "lessThan": "8.20.1"}, {"version": "8.21.0", "status": "affected", "versionType": "semver", "lessThan": "8.22.0"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4", "status": "affected", "versionType": "git", "lessThan": "ea71c3b6b60e563651ea8596a975aef0c8199519"}], "defaultStatus": "unaffected", "repo": "https://github.com/curl/curl.git"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8.21.0", "status": "affected"}, {"version": "8.20.0", "status": "affected"}, {"version": "8.19.0", "status": "affected"}, {"version": "8.18.0", "status": "affected"}, {"version": "8.17.0", "status": "affected"}, {"version": "8.16.0", "status": "affected"}, {"version": "8.15.0", "status": "affected"}, {"version": "8.14.1", "status": "affected"}, {"version": "8.14.0", "status": "affected"}, {"version": "8.13.0", "status": "affected"}, {"version": "8.12.1", "status": "affected"}, {"version": "8.12.0", "status": "affected"}, {"version": "8.11.1", "status": "affected"}, {"version": "8.11.0", "status": "affected"}, {"version": "8.10.1", "status": "affected"}, {"version": "8.10.0", "status": "affected"}, {"version": "8.9.1", "status": "affected"}, {"version": "8.9.0", "status": "affected"}, {"version": "8.8.0", "status": "affected"}, {"version": "8.7.1", "status": "affected"}, {"version": "8.7.0", "status": "affected"}, {"version": "8.6.0", "status": "affected"}, {"version": "8.5.0", "status": "affected"}, {"version": "8.4.0", "status": "affected"}, {"version": "8.3.0", "status": "affected"}, {"version": "8.2.1", "status": "affected"}, {"version": "8.2.0", "status": "affected"}, {"version": "8.1.2", "status": "affected"}, {"version": "8.1.1", "status": "affected"}, {"version": "8.1.0", "status": "affected"}, {"version": "8.0.1", "status": "affected"}, {"version": "8.0.0", "status": "affected"}, {"version": "7.88.1", "status": "affected"}, {"version": "7.88.0", "status": "affected"}, {"version": "7.87.0", "status": "affected"}, {"version": "7.86.0", "status": "affected"}, {"version": "7.85.0", "status": "affected"}, {"version": "7.84.0", "status": "affected"}, {"version": "7.83.1", "status": "affected"}, {"version": "7.83.0", "status": "affected"}, {"version": "7.82.0", "status": "affected"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-13608.json"}, {"url": "https://curl.se/docs/CVE-2026-13608.html"}, {"url": "https://hackerone.com/reports/3822248"}], "x_osv": {"schema_version": "1.5.0", "id": "CURL-CVE-2026-13608", "aliases": ["CVE-2026-13608"], "summary": "OpenLDAP SASL authentication bypass", "modified": "2026-09-07T10:34:51.00Z", "database_specific": {"package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-13608.json", "www": "https://curl.se/docs/CVE-2026-13608.html", "issue": "https://hackerone.com/reports/3822248", "CWE": {"id": "CWE-923", "desc": "Improper Restriction of Communication Channel to Intended Endpoints"}, "last_affected": "8.21.0", "severity": "Low"}, "published": "2026-09-02T08:00:00.00Z", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "7.82.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"}]}, {"type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [{"introduced": "eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4"}, {"fixed": "ea71c3b6b60e563651ea8596a975aef0c8199519"}]}], "versions": ["8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0"]}], "credits": [{"name": "Eunsoo Kim (Autonomous Code Security team at Microsoft)", "type": "finder"}, {"name": "Eunsoo Kim", "type": "remediation developer"}], "details": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Restriction of Communication Channel to Intended Endpoints", "cweId": "CWE-923", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Eunsoo Kim (Autonomous Code Security team at Microsoft)", "type": "finder"}, {"lang": "en", "value": "Eunsoo Kim", "type": "remediation developer"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-923", "lang": "en", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints"}]}], "references": [{"url": "https://hackerone.com/reports/3822248", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-08T15:39:09.395825Z", "id": "CVE-2026-13608", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T15:39:45.194Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-13608", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-08T15:39:09.395825Z"}}}], "references": [{"url": "https://hackerone.com/reports/3822248", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-923", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T15:39:40.949Z"}}], "cna": {"title": "OpenLDAP SASL authentication bypass", "x_osv": {"id": "CURL-CVE-2026-13608", "aliases": ["CVE-2026-13608"], "credits": [{"name": "Eunsoo Kim (Autonomous Code Security team at Microsoft)", "type": "finder"}, {"name": "Eunsoo Kim", "type": "remediation developer"}], "details": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation.", "summary": "OpenLDAP SASL authentication bypass", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "7.82.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}, {"introduced": "8.21.0"}, {"fixed": "8.22.0"}]}, {"repo": "https://github.com/curl/curl.git", "type": "GIT", "events": [{"introduced": "eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4"}, {"fixed": "ea71c3b6b60e563651ea8596a975aef0c8199519"}]}], "versions": ["8.21.0", "8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0"]}], "modified": "2026-09-07T10:34:51.00Z", "published": "2026-09-02T08:00:00.00Z", "schema_version": "1.5.0", "database_specific": {"CWE": {"id": "CWE-923", "desc": "Improper Restriction of Communication Channel to Intended Endpoints"}, "URL": "https://curl.se/docs/CVE-2026-13608.json", "www": "https://curl.se/docs/CVE-2026-13608.html", "issue": "https://hackerone.com/reports/3822248", "affects": "both", "package": "curl", "severity": "Low", "last_affected": "8.21.0"}}, "credits": [{"lang": "en", "type": "finder", "value": "Eunsoo Kim (Autonomous Code Security team at Microsoft)"}, {"lang": "en", "type": "remediation developer", "value": "Eunsoo Kim"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "7.82.0", "lessThan": "8.14.2", "versionType": "semver"}, {"status": "affected", "version": "8.15.0", "lessThan": "8.16.1", "versionType": "semver"}, {"status": "affected", "version": "8.17.0", "lessThan": "8.20.1", "versionType": "semver"}, {"status": "affected", "version": "8.21.0", "lessThan": "8.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4", "lessThan": "ea71c3b6b60e563651ea8596a975aef0c8199519", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.21.0"}, {"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}, {"status": "affected", "version": "8.10.1"}, {"status": "affected", "version": "8.10.0"}, {"status": "affected", "version": "8.9.1"}, {"status": "affected", "version": "8.9.0"}, {"status": "affected", "version": "8.8.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.6.0"}, {"status": "affected", "version": "8.5.0"}, {"status": "affected", "version": "8.4.0"}, {"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.2.1"}, {"status": "affected", "version": "8.2.0"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.0.1"}, {"status": "affected", "version": "8.0.0"}, {"status": "affected", "version": "7.88.1"}, {"status": "affected", "version": "7.88.0"}, {"status": "affected", "version": "7.87.0"}, {"status": "affected", "version": "7.86.0"}, {"status": "affected", "version": "7.85.0"}, {"status": "affected", "version": "7.84.0"}, {"status": "affected", "version": "7.83.1"}, {"status": "affected", "version": "7.83.0"}, {"status": "affected", "version": "7.82.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-13608.json"}, {"url": "https://curl.se/docs/CVE-2026-13608.html"}, {"url": "https://hackerone.com/reports/3822248"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-923", "description": "Improper Restriction of Communication Channel to Intended Endpoints"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:45.788Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13608", "state": "PUBLISHED", "dateUpdated": "2026-09-15T06:02:45.788Z", "dateReserved": "2026-06-29T08:57:44.945Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2026-09-06T17:47:01.951Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThan": "8.14.2", "status": "affected", "version": "7.82.0", "versionType": "semver"}, {"lessThan": "8.16.1", "status": "affected", "version": "8.15.0", "versionType": "semver"}, {"lessThan": "8.20.1", "status": "affected", "version": "8.17.0", "versionType": "semver"}, {"lessThan": "8.22.0", "status": "affected", "version": "8.21.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "curl", "repo": "https://github.com/curl/curl.git", "vendor": "curl", "versions": [{"lessThan": "ea71c3b6b60e563651ea8596a975aef0c8199519", "status": "affected", "version": "eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"status": "affected", "version": "8.21.0"}, {"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}, {"status": "affected", "version": "8.10.1"}, {"status": "affected", "version": "8.10.0"}, {"status": "affected", "version": "8.9.1"}, {"status": "affected", "version": "8.9.0"}, {"status": "affected", "version": "8.8.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.6.0"}, {"status": "affected", "version": "8.5.0"}, {"status": "affected", "version": "8.4.0"}, {"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.2.1"}, {"status": "affected", "version": "8.2.0"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.0.1"}, {"status": "affected", "version": "8.0.0"}, {"status": "affected", "version": "7.88.1"}, {"status": "affected", "version": "7.88.0"}, {"status": "affected", "version": "7.87.0"}, {"status": "affected", "version": "7.86.0"}, {"status": "affected", "version": "7.85.0"}, {"status": "affected", "version": "7.84.0"}, {"status": "affected", "version": "7.83.1"}, {"status": "affected", "version": "7.83.0"}, {"status": "affected", "version": "7.82.0"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "matchCriteriaId": "63FC8E38-A863-458D-9C6F-8F47F1149421", "versionEndExcluding": "8.22.0", "versionStartIncluding": "7.82.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."}], "id": "CVE-2026-13608", "lastModified": "2026-09-15T07:16:26.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13608", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-08T15:39:09.395825Z", "version": "2.0.3"}}]}, "published": "2026-09-06T18:17:19.810", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Patch", "Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-13608.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-13608.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Exploit", "Third Party Advisory"], "url": "https://hackerone.com/reports/3822248"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://hackerone.com/reports/3822248"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-923"}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-923"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack", "id": "2529198", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529198"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-347", "details": ["A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation.", "A flaw was found in libcurl's SASL (Simple Authentication and Security Layer) negotiation for LDAP (Lightweight Directory Access Protocol) authentication when using the OpenLDAP backend. An incomplete handshake sequence can be misinterpreted as a successful cryptographic verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack, could inject a premature response to bypass complete peer validation, leading to an authentication bypass."], "name": "CVE-2026-13608", "package_state": [{"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Under investigation", "package_name": "build-of-trustee/trustee-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Under investigation", "package_name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "igvm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "s390utils", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Under investigation", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "openshell", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "foreman", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "puppet-agent", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-09-06T17:47:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-13608\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-13608\nhttps://curl.se/docs/CVE-2026-13608.html\nhttps://curl.se/docs/CVE-2026-13608.json\nhttps://hackerone.com/reports/3822248"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.21.0,8.21.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.20.0,8.20.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.19.0,8.19.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.18.0,8.18.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.17.0,8.17.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.16.0,8.16.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.15.0,8.15.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.14.1,8.14.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.14.0,8.14.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.13.0,8.13.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.12.1,8.12.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.12.0,8.12.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.11.1,8.11.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.11.0,8.11.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.10.1,8.10.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.10.0,8.10.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.9.1,8.9.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.9.0,8.9.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.8.0,8.8.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.7.1,8.7.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.7.0,8.7.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.6.0,8.6.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.5.0,8.5.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.4.0,8.4.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.3.0,8.3.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.1,8.2.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.0,8.2.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.2,8.1.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.1,8.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.0,8.1.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.1,8.0.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.88.1,7.88.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.88.0,7.88.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.87.0,7.87.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.86.0,7.86.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.85.0,7.85.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.84.0,7.84.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.83.1,7.83.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.83.0,7.83.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.82.0,7.82.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "curl", "source": "cna", "vendor": "curl"}, "product": "curl", "vendor": "curl"}], "created": "2026-09-06T19:30:11.744728+00:00", "updated": "2026-09-21T13:30:16.805943+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}