DeutschShown in its original language — a full translation is planned for a future version.
cURL: Mehrere Schwachstellen
view advisory published 2026-10-13
Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.
01
describes (23)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-94266US | — | — | ||
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s
`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither
the URL provided to libcurl nor the… | ||||
| CVE-2026-94265US | —OT elevated | — | ||
When processing an HTTP redirect to a URL containing userinfo (a
`username:password` component), curl might erroneously retain and re-transmit
the original host's HTTP Negotiate au… | ||||
| CVE-2026-92391US | — | — | ||
A deeply nested multipart MIME structure constructed via the public API causes
a stack overflow in libcurl during normal cleanup operations. An excessive
recursion depth within `cu… | ||||
| CVE-2026-92390US | — | — | ||
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its
documented anti-clobbering protection if an intermediate 103 Early Hints
response precedes the final HTT… | ||||
| CVE-2026-92389US | — | — | ||
libcurl's TFTP state machine fails to validate state transitions against the
requested transfer direction, accepting opening server responses for both
reads and writes interchangea… | ||||
| CVE-2026-92388US | — | — | ||
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration
path meant for successful listings, leaving the write callback set to the
internal listing parser and the… | ||||
| CVE-2026-92387US | — | — | ||
By permanently omitting the final control-response line, a malicious FTP,
IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its
configured transfer timeout mecha… | ||||
| CVE-2026-92386US | — | — | ||
When writing a long cookie name and value to a Netscape cookie jar, a remote
HTTP server can make `curl` write a record that exceeds its line-length
parsing limit. Consequently, an… | ||||
| CVE-2026-87866US | — | — | ||
When built with wolfSSL, curl can successfully validate a pinned public key
hash against a key the TLS peer does not possess. During the TLS handshake,
wolfSSL validates the connec… | ||||
| CVE-2026-87865US | — | — | ||
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated
initial entry can cause host key validation to report a key *mismatch* as a
*missing* key to the `CURLOPT_S… | ||||
| CVE-2026-87864US | — | — | ||
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in
the `IMAP APPEND {N}` literal while transmitting line-ending expanded data.
The server reads only $N$ b… | ||||
| CVE-2026-87863US | — | — | ||
An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values c… | ||||
| CVE-2026-87862US | —OT elevated | — | ||
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy… | ||||
| CVE-2026-87861US | —OT elevated | — | ||
When using ambient user credentials, an HTTP request directed to one origin
may be dispatched over a connection previously authenticated via Negotiate for
a different origin, leavi… | ||||
| CVE-2026-86415US | — | — | ||
libcurl's connection cache match function never considers the automatic client
certificate option, so a cached, already authenticated Schannel connection can
be handed to a transfe… | ||||
| CVE-2026-86414US | — | — | ||
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic
password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering
the `CONNECT` tunnel reques… | ||||
| CVE-2026-107929US | — | — | ||
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is
set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that
binding is not part of the c… | ||||
| CVE-2026-107928US | — | — | ||
When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer. This is due to an out of bounds read
following when `gnutls_record_send… | ||||
| CVE-2026-86413US | — | — | ||
When using an *ambient user* in a first transfer doing Negotiate
authentication and asked to follow redirects, curl could pass on its
credential details to an unrelated second orig… | ||||
| CVE-2026-86412US | — | — | ||
A remote HTTP server can set a cookie that curl accepts and writes to a
Netscape cookie jar but cannot reload. On the next invocation using the same
path for `--cookie` and `--cook… | ||||
showing 20 of 23
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:80349 vom 2026-10-15external
- Red Hat Security Advisory RHSA-2026:82895 vom 2026-10-14external
- Curl Document vom 2026-10-13external
- Curl Document vom 2026-10-13external
- Curl Document vom 2026-10-13external
- Curl Document vom 2026-10-13external
- Curl Document vom 2026-10-13external
- Curl Document vom 2026-10-13external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan