What’s Vulnerable › Products

curl vulnerabilities

194 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 79 published in the last 12 months.

Check whether your curl version is affected

Latest curl vulnerabilities

• CVE-2026-107929 — local interface connection reuse mixup (CVSS 8.1)
• CVE-2026-107928 — info leak uploading over WebSockets with GnuTLS (CVSS 8.1)
• CVE-2026-94266 — password leak in CURLINFO_EFFECTIVE_URL (CVSS 7.5)
• CVE-2026-94265 — Authorization: Negotiate sent to foreign origin (CVSS 9.1)
• CVE-2026-92391 — curl_mime_free stack overflow by recursion (CVSS 7.5)
• CVE-2026-92390 — -J no-clobber guarantee bypassed with 103 early hints (CVSS 7.5)
• CVE-2026-92389 — TFTP direction confusion (CVSS 8.1)
• CVE-2026-92388 — FTP wildcard write callback mixup (CVSS 9.1)
• CVE-2026-92387 — never-ending loop via server response omission (CVSS 8.1)
• CVE-2026-92386 — server-set cookie aborts cookie jar load (CVSS 8.1)
• CVE-2026-87866 — wolfSSL public-key pinning bypass (CVSS 9.1)
• CVE-2026-87865 — knownhost callback mismatches key as missing (CVSS 7.4)
• CVE-2026-87863 — HSTS response erases persisted entries (CVSS 8.1)
• CVE-2026-87864 — IMAP APPEND plus CRLF conversion command injection (CVSS 8.1)
• CVE-2026-87862 — HSTS cache import drops longer-lived child (CVSS 8.1)
• CVE-2026-87861 — cross-origin reuse of a Negotiate connection (CVSS 9.1)
• CVE-2026-86415 — auto client cert connection reuse mixup (CVSS 7.5)
• CVE-2026-86414 — leaking host credentials to HTTP proxy (CVSS 9.1)
• CVE-2026-86413 — Negotiate credentials sent to redirected origin (CVSS 9.1)
• CVE-2026-86412 — server-set cookie erases cookie jar (CVSS 8.1)
• CVE-2026-86411 — FTP connection reuse inherits client-certificate (CVSS 9.1)
• CVE-2026-86410 — redirect to SFTP or SCP bypasses host verification (CVSS 8.1)
• CVE-2026-86409 — stale SigV4 headers sent unintended (CVSS 8.1)
• CVE-2026-92392 — HTTP/2 upload Use-After-Free (CVSS 8.1)
• CVE-2026-82209 — domain-scoped PSL domain cookie (CVSS 8.2)