CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 06:30 UTC)

What this means for you

This week: 5,437 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,437; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product haxx:curl. Show all products

99 CVEs, showing 1 to 50Page 1 of 2Next

CVE	Severity	Title	Published
CVE-2026-82209	High 8.2	domain-scoped PSL domain cookie Assigned by curl	Sep 6, 2026
CVE-2026-82208	High 7.5	wolfSSL CA-cache hit overrides callback Assigned by curl	Sep 6, 2026
CVE-2026-80255	High 7.5	secure cookie attribute bypass with tab Assigned by curl	Sep 6, 2026
CVE-2026-80231	High 7.5	native CA store conn reuse Assigned by curl	Sep 6, 2026
CVE-2026-80230	High 7.5	OpenSSL pinning bypass Assigned by curl	Sep 6, 2026
CVE-2026-80229	High 7.5	OpenSSL provider use-after-free Assigned by curl	Sep 6, 2026
CVE-2026-19931	Critical 9.8	Negotiate ambient user conn reuse Assigned by curl	Sep 6, 2026
CVE-2026-18924	Critical 9.1	HTTP/2 server push UAF Assigned by curl	Sep 6, 2026
CVE-2026-13608	High 7.4	OpenLDAP SASL authentication bypass Assigned by curl	Sep 6, 2026
CVE-2026-9547	High 7.4	When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server.	Jul 3, 2026
CVE-2026-9546	High 7.5	A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared.	Jul 3, 2026
CVE-2026-9545	High 7.5	In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - w…	Jul 3, 2026
CVE-2026-9080	High 7.3	Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer i…	Jul 3, 2026
CVE-2026-9079	Critical 9.8	libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know…	Jul 3, 2026
CVE-2026-8932	High 7.5	libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.	Jul 3, 2026
CVE-2026-8927	Critical 9.1	When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests.	Jul 3, 2026
CVE-2026-8926	Critical 9.1	When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and us…	Jul 3, 2026
CVE-2026-8925	Critical 9.8	The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it `free()` the same pointer twice.	Jul 3, 2026
CVE-2026-8924	Critical 9.1	A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check.	Jul 3, 2026
CVE-2026-8458	Medium 6.5	libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".	Jul 3, 2026
CVE-2026-8286	High 8.1	A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.	Jul 3, 2026
CVE-2026-12064	High 7.5	When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl.	Jul 3, 2026
CVE-2026-11856	Critical 9.8	Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with Digest authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing…	Jul 3, 2026
CVE-2026-11586	High 7.5	By default, curl automatically responds to WebSocket PING frames.	Jul 3, 2026
CVE-2026-11564	Critical 9.1	libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.	Jul 3, 2026
CVE-2026-11352	High 7.5	An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client.	Jul 3, 2026
CVE-2026-10536	Critical 9.8	A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl…	Jul 3, 2026
CVE-2026-7168	Medium 5.3	Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with Digest authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reu…	May 13, 2026
CVE-2026-7009	Medium 5.3	When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and inste…	May 13, 2026
CVE-2026-6429	Medium 5.3	When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.	May 13, 2026
CVE-2026-6276	High 7.5	Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom `Host:` header set, the seco…	May 13, 2026
CVE-2026-6253	Medium 5.9	curl might erroneously pass on credentials for a first proxy to a second proxy.	May 13, 2026
CVE-2026-5773	High 7.5	libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.	May 13, 2026
CVE-2026-5545	Medium 6.5	libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.	May 13, 2026
CVE-2026-4873	Medium 5.9	A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool.	May 13, 2026
CVE-2026-3805	High 7.5	When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.	Mar 11, 2026
CVE-2026-3784	Medium 6.5	curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy.	Mar 11, 2026
CVE-2026-3783	Medium 5.3	When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances.	Mar 11, 2026
CVE-2026-1965	Medium 6.5	libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request.	Mar 11, 2026
CVE-2025-15224	Low 3.1	When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.	Jan 8, 2026
CVE-2025-15079	Medium 5.3	When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were a…	Jan 8, 2026
CVE-2025-14819	Medium 5.3	When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the par…	Jan 8, 2026
CVE-2025-14524	Medium 5.3	When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass…	Jan 8, 2026
CVE-2025-14017	Medium 6.3	When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrent…	Jan 8, 2026
CVE-2025-13034	Medium 5.9	When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the server certificate to verify the peer.	Jan 8, 2026
CVE-2025-10966	Medium 4.3	curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.	Nov 7, 2025
CVE-2025-0725	High 7.3	gzip integer overflow Assigned by curl	Feb 5, 2025
CVE-2025-0665	High 7.0	eventfd double close Assigned by curl	Feb 5, 2025
CVE-2025-0167	Low 3.4	netrc and default credential leak Assigned by curl	Feb 5, 2025
CVE-2024-11053	Low 3.4	netrc and redirect credential leak Assigned by curl	Dec 11, 2024

Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.