Most recent entries from all

BELL-CVE-2026-80230

Affected: Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl

certfr-2026-avi-1108 — De multiples vulnérabilités ont été découvertes dans Curl. Certaines d'entre elles permettent à un attaquant de provoqu…

certfr-2026-avi-1108

fkie_cve-2026-80230

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

GHSA-2xgv-7q8p-67gc

msrc_CVE-2026-80230 — OpenSSL pinning bypass

msrc_CVE-2026-80230

OESA-2026-4124 — curl security update

Affected: openEuler:20.03-LTS-SP4: curl

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.(CVE-2026-11856)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

A flaw in libcurl makes it wrongly reuse an existing HTTPS con…

openSUSE-SU-2026:11696-1 — curl-8.22.0-1.1 on GA media

curl-8.22.0-1.1 on GA media

RHSA-2026:63161 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication curl: curl: Public key pinning bypass allows unauthenticated connections curl: curl: Incorrect HTTPS connection reuse with Native CA Store curl: curl: Information disclosure due to secure cookie attribute bypass curl: libcurl: Information disclosure via improper Public Suffix List boundary check

SUSE-SU-2026:23498-1 — Security update for curl

Security update for curl

UBUNTU-CVE-2026-80230

Affected: Ubuntu:Pro:16.04:LTS: curl, Ubuntu:Pro:18.04:LTS: curl, Ubuntu:Pro:20.04:LTS: curl, Ubuntu:22.04:LTS: curl, Ubuntu:24.04:LTS: curl, Ubuntu:26.04:LTS: curl