# curl.

Every CVE that names curl among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [local interface connection reuse mixup](https://agentprime.io/advisories/CVE-2026-107929.md)
  `CVE-2026-107929` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-488
- [info leak uploading over WebSockets with GnuTLS](https://agentprime.io/advisories/CVE-2026-107928.md)
  `CVE-2026-107928` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-126
- [password leak in CURLINFO_EFFECTIVE_URL](https://agentprime.io/advisories/CVE-2026-94266.md)
  `CVE-2026-94266` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Hard-coded credentials
- [Authorization: Negotiate sent to foreign origin](https://agentprime.io/advisories/CVE-2026-94265.md)
  `CVE-2026-94265` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [curl_mime_free stack overflow by recursion](https://agentprime.io/advisories/CVE-2026-92391.md)
  `CVE-2026-92391` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [\-J no-clobber guarantee bypassed with 103 early hints](https://agentprime.io/advisories/CVE-2026-92390.md)
  `CVE-2026-92390` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [TFTP direction confusion](https://agentprime.io/advisories/CVE-2026-92389.md)
  `CVE-2026-92389` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [FTP wildcard write callback mixup](https://agentprime.io/advisories/CVE-2026-92388.md)
  `CVE-2026-92388` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [never-ending loop via server response omission](https://agentprime.io/advisories/CVE-2026-92387.md)
  `CVE-2026-92387` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [server-set cookie aborts cookie jar load](https://agentprime.io/advisories/CVE-2026-92386.md)
  `CVE-2026-92386` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-1284
- [wolfSSL public-key pinning bypass](https://agentprime.io/advisories/CVE-2026-87866.md)
  `CVE-2026-87866` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS
- [knownhost callback mismatches key as missing](https://agentprime.io/advisories/CVE-2026-87865.md)
  `CVE-2026-87865` · CVE record: curl curl · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS
- [HSTS response erases persisted entries](https://agentprime.io/advisories/CVE-2026-87863.md)
  `CVE-2026-87863` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [IMAP APPEND plus CRLF conversion command injection](https://agentprime.io/advisories/CVE-2026-87864.md)
  `CVE-2026-87864` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-130
- [HSTS cache import drops longer-lived child](https://agentprime.io/advisories/CVE-2026-87862.md)
  `CVE-2026-87862` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [cross-origin reuse of a Negotiate connection](https://agentprime.io/advisories/CVE-2026-87861.md)
  `CVE-2026-87861` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [auto client cert connection reuse mixup](https://agentprime.io/advisories/CVE-2026-86415.md)
  `CVE-2026-86415` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [leaking host credentials to HTTP proxy](https://agentprime.io/advisories/CVE-2026-86414.md)
  `CVE-2026-86414` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [Negotiate credentials sent to redirected origin](https://agentprime.io/advisories/CVE-2026-86413.md)
  `CVE-2026-86413` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [server-set cookie erases cookie jar](https://agentprime.io/advisories/CVE-2026-86412.md)
  `CVE-2026-86412` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-754
- [FTP connection reuse inherits client-certificate](https://agentprime.io/advisories/CVE-2026-86411.md)
  `CVE-2026-86411` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-488
- [redirect to SFTP or SCP bypasses host verification](https://agentprime.io/advisories/CVE-2026-86410.md)
  `CVE-2026-86410` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS
- [stale SigV4 headers sent unintended](https://agentprime.io/advisories/CVE-2026-86409.md)
  `CVE-2026-86409` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [HTTP/2 upload Use-After-Free](https://agentprime.io/advisories/CVE-2026-92392.md)
  `CVE-2026-92392` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Memory corruption
- [domain-scoped PSL domain cookie](https://agentprime.io/advisories/CVE-2026-82209.md)
  `CVE-2026-82209` · CVE record: curl curl · CVSS 8.2 High · Not analysed yet · Published 6 Sept 2026 · Tags: Information disclosure
- [wolfSSL CA-cache hit overrides callback](https://agentprime.io/advisories/CVE-2026-82208.md)
  `CVE-2026-82208` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 6 Sept 2026 · Tags: Weak cryptography or TLS
- [secure cookie attribute bypass with tab](https://agentprime.io/advisories/CVE-2026-80255.md)
  `CVE-2026-80255` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 6 Sept 2026 · Tags: Information disclosure
- [native CA store conn reuse](https://agentprime.io/advisories/CVE-2026-80231.md)
  `CVE-2026-80231` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 6 Sept 2026 · Tags: CWE-488
- [OpenSSL pinning bypass](https://agentprime.io/advisories/CVE-2026-80230.md)
  `CVE-2026-80230` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 6 Sept 2026 · Tags: Weak cryptography or TLS
- [OpenSSL provider use-after-free](https://agentprime.io/advisories/CVE-2026-80229.md)
  `CVE-2026-80229` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 6 Sept 2026 · Tags: Memory corruption
- [Negotiate ambient user conn reuse](https://agentprime.io/advisories/CVE-2026-19931.md)
  `CVE-2026-19931` · CVE record: curl curl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: CWE-488
- [HTTP/2 server push UAF](https://agentprime.io/advisories/CVE-2026-18924.md)
  `CVE-2026-18924` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Memory corruption
- [OpenLDAP SASL authentication bypass](https://agentprime.io/advisories/CVE-2026-13608.md)
  `CVE-2026-13608` · CVE record: curl curl · CVSS 7.4 High · Not analysed yet · Published 6 Sept 2026 · Tags: CWE-923
- [SSH improper host validation](https://agentprime.io/advisories/CVE-2026-9547.md)
  `CVE-2026-9547` · CVE record: curl curl · CVSS 7.4 High · Not analysed yet · Published 3 Jul 2026 · Tags: Weak cryptography or TLS
- [sending old referer](https://agentprime.io/advisories/CVE-2026-9546.md)
  `CVE-2026-9546` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2026 · Tags: Information disclosure
- [exposing HTTP/3 early data](https://agentprime.io/advisories/CVE-2026-9545.md)
  `CVE-2026-9545` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2026 · Tags: Information disclosure
- [UAF after pause in socket callback](https://agentprime.io/advisories/CVE-2026-9080.md)
  `CVE-2026-9080` · CVE record: curl curl · CVSS 7.3 High · Not analysed yet · Published 3 Jul 2026 · Tags: Memory corruption
- [stale proxy password leak](https://agentprime.io/advisories/CVE-2026-9079.md)
  `CVE-2026-9079` · CVE record: curl curl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jul 2026 · Tags: Hard-coded credentials
- [incomplete mTLS config matching in conn reuse](https://agentprime.io/advisories/CVE-2026-8932.md)
  `CVE-2026-8932` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-305
- [env-set cross-proxy Digest auth state leak](https://agentprime.io/advisories/CVE-2026-8927.md)
  `CVE-2026-8927` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jul 2026 · Tags: Authentication bypass
- [password leak with netrc and user in URL](https://agentprime.io/advisories/CVE-2026-8926.md)
  `CVE-2026-8926` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jul 2026 · Tags: Hard-coded credentials
- [SASL double-free](https://agentprime.io/advisories/CVE-2026-8925.md)
  `CVE-2026-8925` · CVE record: curl curl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jul 2026 · Tags: Memory corruption
- [trailing dot domain super cookie](https://agentprime.io/advisories/CVE-2026-8924.md)
  `CVE-2026-8924` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jul 2026 · Tags: Information disclosure
- [wrong reuse for different services](https://agentprime.io/advisories/CVE-2026-8458.md)
  `CVE-2026-8458` · CVE record: curl curl · CVSS 6.5 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-488
- [wrong STARTTLS connection reuse](https://agentprime.io/advisories/CVE-2026-8286.md)
  `CVE-2026-8286` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 3 Jul 2026 · Tags: Weak cryptography or TLS
- [proto-default skips SSH verification](https://agentprime.io/advisories/CVE-2026-12064.md)
  `CVE-2026-12064` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2026 · Tags: Weak cryptography or TLS
- [cross-origin Digest auth state leak](https://agentprime.io/advisories/CVE-2026-11856.md)
  `CVE-2026-11856` · CVE record: curl curl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jul 2026 · Tags: Authentication bypass
- [WS Auto-PONG memory exhaustion](https://agentprime.io/advisories/CVE-2026-11586.md)
  `CVE-2026-11586` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2026 · Tags: Denial of service
- [Native CA trust persist](https://agentprime.io/advisories/CVE-2026-11564.md)
  `CVE-2026-11564` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jul 2026 · Tags: Weak cryptography or TLS
- [QUIC zero-length UDP datagrams busy-loop](https://agentprime.io/advisories/CVE-2026-11352.md)
  `CVE-2026-11352` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2026 · Tags: Denial of service
- [HTTP/2 stream-dependency tree UAF](https://agentprime.io/advisories/CVE-2026-10536.md)
  `CVE-2026-10536` · CVE record: curl curl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jul 2026 · Tags: Memory corruption
- [cross-proxy Digest auth state leak](https://agentprime.io/advisories/CVE-2026-7168.md)
  `CVE-2026-7168` · CVE record: curl curl · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2026 · Tags: Authentication bypass
- [OCSP stapling bypass with Apple SecTrust](https://agentprime.io/advisories/CVE-2026-7009.md)
  `CVE-2026-7009` · CVE record: curl curl · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2026
- [netrc credential leak with reused proxy connection](https://agentprime.io/advisories/CVE-2026-6429.md)
  `CVE-2026-6429` · CVE record: curl curl · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2026 · Tags: Information disclosure
- [stale custom cookie host causes cookie leak](https://agentprime.io/advisories/CVE-2026-6276.md)
  `CVE-2026-6276` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-346
- [proxy credentials leak over redirect-to proxy](https://agentprime.io/advisories/CVE-2026-6253.md)
  `CVE-2026-6253` · CVE record: curl curl · CVSS 5.9 Medium · Not analysed yet · Published 13 May 2026 · Tags: Hard-coded credentials
- [wrong reuse of SMB connection](https://agentprime.io/advisories/CVE-2026-5773.md)
  `CVE-2026-5773` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-488
- [wrong reuse of HTTP Negotiate connection](https://agentprime.io/advisories/CVE-2026-5545.md)
  `CVE-2026-5545` · CVE record: curl curl · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2026 · Tags: CWE-305
- [connection reuse ignores TLS requirement](https://agentprime.io/advisories/CVE-2026-4873.md)
  `CVE-2026-4873` · CVE record: curl curl · CVSS 5.9 Medium · Not analysed yet · Published 13 May 2026 · Tags: Weak cryptography or TLS
- [use after free in SMB connection reuse](https://agentprime.io/advisories/CVE-2026-3805.md)
  `CVE-2026-3805` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 11 Mar 2026 · Tags: Memory corruption

Older: <https://agentprime.io/advisories/technology/curl.md?cursor=WyIyMDI2LTAzLTExVDEwOjA5OjM3LjcyOTAwMFoiLCJDVkUtMjAyNi0zODA1Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=curl>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/curl/>. Everything for agents: <https://agentprime.io/llms.txt>.