Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

curl — Vulnerabilities & Security Advisories 122

All 122 CVE vulnerabilities found in curl, with AI-generated Chinese analysis, references, and POCs.

This page documents Common Weakness Enumeration vulnerabilities associated with the curl product developed by Daniel Stenberg and the community. It aggregates security flaw data to provide a comprehensive view of the software’s historical and current risk landscape. The content collects vulnerability reports spanning from the initial public releases of curl up to the most recent updates, ensuring a complete chronological record of security issues. Users can discover detailed information by tracking vendor advisories, understanding specific weakness classes such as buffer overflows or use-after-free errors, and examining the full vulnerability history of the product. This resource is designed for security researchers, developers, and system administrators who need to assess the impact of known flaws on their deployments. By centralizing this data, the page facilitates better risk management and informed decision-making regarding updates and mitigations. The aggregation process relies on official advisories, CVE entries, and community-reported issues to maintain accuracy and completeness. Readers are encouraged to use the available tools to filter results by date, severity, or specific weakness types. This approach supports proactive security practices by highlighting patterns in vulnerability discovery and resolution for the curl ecosystem.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-107929 local interface connection reuse mixup - - 2026-10-20
CVE-2026-107928 info leak uploading over WebSockets with GnuTLS - - 2026-10-20
CVE-2026-94266 password leak in CURLINFO_EFFECTIVE_URL - - 2026-10-20
CVE-2026-94265 Authorization: Negotiate sent to foreign origin - - 2026-10-20
CVE-2026-92391 curl_mime_free stack overflow by recursion - - 2026-10-20
CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints - - 2026-10-20
CVE-2026-92389 TFTP direction confusion - - 2026-10-20
CVE-2026-92388 FTP wildcard write callback mixup - - 2026-10-20
CVE-2026-92387 never-ending loop via server response omission - - 2026-10-20
CVE-2026-92386 server-set cookie aborts cookie jar load - - 2026-10-20
CVE-2026-87866 wolfSSL public-key pinning bypass - - 2026-10-20
CVE-2026-87865 knownhost callback mismatches key as missing - - 2026-10-20
CVE-2026-87863 HSTS response erases persisted entries - - 2026-10-20
CVE-2026-87864 IMAP APPEND plus CRLF conversion command injection - - 2026-10-20
CVE-2026-87862 HSTS cache import drops longer-lived child - - 2026-10-20
CVE-2026-87861 cross-origin reuse of a Negotiate connection - - 2026-10-20
CVE-2026-86415 auto client cert connection reuse mixup - - 2026-10-20
CVE-2026-86414 leaking host credentials to HTTP proxy - - 2026-10-20
CVE-2026-86413 Negotiate credentials sent to redirected origin - - 2026-10-20
CVE-2026-86412 server-set cookie erases cookie jar - - 2026-10-20
CVE-2026-86411 FTP connection reuse inherits client-certificate - - 2026-10-20
CVE-2026-86410 redirect to SFTP or SCP bypasses host verification - - 2026-10-20
CVE-2026-86409 stale SigV4 headers sent unintended - - 2026-10-20
CVE-2026-92392 HTTP/2 upload Use-After-Free - - 2026-10-14
CVE-2026-82209 domain-scoped PSL domain cookie CWE-201 - - 2026-09-06
CVE-2026-82208 wolfSSL CA-cache hit overrides callback CWE-295 - - 2026-09-06
CVE-2026-80255 secure cookie attribute bypass with tab CWE-201 - - 2026-09-06
CVE-2026-80231 native CA store conn reuse CWE-488 - - 2026-09-06
CVE-2026-80230 OpenSSL pinning bypass CWE-295 - - 2026-09-06
CVE-2026-80229 OpenSSL provider use-after-free CWE-416 - - 2026-09-06

All 122 known CVE vulnerabilities affecting curl with full Chinese analysis, references, and POCs where available.