Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

curl — Vulnerabilities & Security Advisories 122

All 122 CVE vulnerabilities found in curl, with AI-generated Chinese analysis, references, and POCs.

This page documents Common Weakness Enumeration vulnerabilities associated with the curl product developed by Daniel Stenberg and the community. It aggregates security flaw data to provide a comprehensive view of the software’s historical and current risk landscape. The content collects vulnerability reports spanning from the initial public releases of curl up to the most recent updates, ensuring a complete chronological record of security issues. Users can discover detailed information by tracking vendor advisories, understanding specific weakness classes such as buffer overflows or use-after-free errors, and examining the full vulnerability history of the product. This resource is designed for security researchers, developers, and system administrators who need to assess the impact of known flaws on their deployments. By centralizing this data, the page facilitates better risk management and informed decision-making regarding updates and mitigations. The aggregation process relies on official advisories, CVE entries, and community-reported issues to maintain accuracy and completeness. Readers are encouraged to use the available tools to filter results by date, severity, or specific weakness types. This approach supports proactive security practices by highlighting patterns in vulnerability discovery and resolution for the curl ecosystem.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-19931 Negotiate ambient user conn reuse CWE-488 - - 2026-09-06
CVE-2026-18924 HTTP/2 server push UAF CWE-416 - - 2026-09-06
CVE-2026-13608 OpenLDAP SASL authentication bypass CWE-923 - - 2026-09-06
CVE-2026-9547 SSH improper host validation CWE-297 - - 2026-07-03
CVE-2026-9546 sending old referer CWE-200 - - 2026-07-03
CVE-2026-9545 exposing HTTP/3 early data CWE-200 - - 2026-07-03
CVE-2026-9080 UAF after pause in socket callback CWE-416 - - 2026-07-03
CVE-2026-9079 stale proxy password leak CWE-522 - - 2026-07-03
CVE-2026-8932 incomplete mTLS config matching in conn reuse CWE-305 - - 2026-07-03
CVE-2026-8927 env-set cross-proxy Digest auth state leak CWE-294 - - 2026-07-03
CVE-2026-8926 password leak with netrc and user in URL CWE-522 - - 2026-07-03
CVE-2026-8925 SASL double-free CWE-415 - - 2026-07-03
CVE-2026-8924 trailing dot domain super cookie CWE-201 - - 2026-07-03
CVE-2026-8458 wrong reuse for different services CWE-488 - - 2026-07-03
CVE-2026-8286 wrong STARTTLS connection reuse CWE-295 - - 2026-07-03
CVE-2026-12064 proto-default skips SSH verification CWE-297 - - 2026-07-03
CVE-2026-11856 cross-origin Digest auth state leak CWE-294 - - 2026-07-03
CVE-2026-11586 WS Auto-PONG memory exhaustion CWE-770 - - 2026-07-03
CVE-2026-11564 Native CA trust persist CWE-295 - - 2026-07-03
CVE-2026-11352 QUIC zero-length UDP datagrams busy-loop CWE-835 - - 2026-07-03
CVE-2026-10536 HTTP/2 stream-dependency tree UAF CWE-416 - - 2026-07-03
CVE-2026-7168 cross-proxy Digest auth state leak CWE-294 - - 2026-05-13
CVE-2026-7009 OCSP stapling bypass with Apple SecTrust - - 2026-05-13
CVE-2026-6429 netrc credential leak with reused proxy connection CWE-200 - - 2026-05-13
CVE-2026-6276 stale custom cookie host causes cookie leak CWE-346 - - 2026-05-13
CVE-2026-6253 proxy credentials leak over redirect-to proxy CWE-522 - - 2026-05-13
CVE-2026-5773 wrong reuse of SMB connection CWE-488 - - 2026-05-13
CVE-2026-5545 wrong reuse of HTTP Negotiate connection CWE-305 - - 2026-05-13
CVE-2026-4873 connection reuse ignores TLS requirement CWE-319 - - 2026-05-13
CVE-2026-3805 use after free in SMB connection reuse CWE-416 9.1 - 2026-03-11

All 122 known CVE vulnerabilities affecting curl with full Chinese analysis, references, and POCs where available.