SB2026090233 - Multiple vulnerabilities in cURL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090233

SB2026090233 - Multiple vulnerabilities in cURL

Published: September 2, 2026

Security Bulletin ID SB2026090233
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-82209)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to information exposure through sent data in the libcurl cookie handling logic when processing a Set-Cookie header with a Domain attribute matching an origin host that is itself a public suffix. A remote attacker can induce the client to send a previously stored cookie to an arbitrary sibling subdomain under the same public suffix to disclose sensitive information.

Exploitation requires libpsl support to be enabled, the apex public-suffix host to issue the cookie, and the client to subsequently contact an attacker-controlled sibling subdomain.


2) Improper Certificate Validation (CVE-ID: CVE-2026-82208)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass certificate validation.

The vulnerability exists due to improper certificate validation in the wolfSSL backend when handling TLS connections after a CURLOPT_SSL_CTX_FUNCTION callback replaces the trust store. A remote attacker can present a certificate trusted by the cached store to bypass certificate validation.

This issue only affects libcurl builds that use the wolfSSL TLS backend with CA caching enabled and a CURLOPT_SSL_CTX_FUNCTION callback that replaces the trust store. The curl command line tool is not affected.


3) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-80255)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper cookie attribute handling in the Set-Cookie header processing logic when parsing a Set-Cookie header that uses a tab immediately before the Secure attribute. A remote attacker can send a specially crafted Set-Cookie header to disclose sensitive information.

The issue can cause a cookie to be stored without its Secure flag and then be sent over plaintext HTTP on subsequent requests to the same host.


4) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-80231)

CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass intended certificate validation settings.

The vulnerability exists due to exposure of data element to wrong session in HTTPS connection reuse logic when reusing an existing connection for the same hostname with a different native CA store setting. A remote user can cause a transfer to use a previously established HTTPS connection to bypass intended certificate validation settings.

This issue affects Windows and macOS and also impacts the curl command line tool.


5) Improper Certificate Validation (CVE-ID: CVE-2026-80230)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass public key pinning.

The vulnerability exists due to improper certificate validation in libcurl and the curl command line tool when establishing TLS connections with CURLOPT_PINNEDPUBLICKEY configured and peer and host verification disabled. A remote attacker can present a connection without a server certificate to bypass public key pinning.

This issue is present only when curl is built with OpenSSL or a fork such as BoringSSL, AWS-LC, LibreSSL, or QuicTLS, and the insecure configuration also permits certificate-less connections.


6) Use-after-free (CVE-ID: CVE-2026-80229)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in libcurl multi interface connection reuse handling when performing transfers over pooled TLS connections with OpenSSL 3 providers. A remote user can trigger premature easy handle destruction during connection reuse to cause a denial of service.

This affects libcurl built with OpenSSL 3+ provider configurations and also impacts the curl command line tool.


7) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-19931)

CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause requests to be sent over another user's previously authenticated connection.

The vulnerability exists due to exposure of data element to wrong session in HTTP connection reuse for Negotiate authentication when reusing a connection established with empty credentials. A remote user can issue a request using blank credentials to cause requests to be sent over another user's previously authenticated connection.

This issue affects libcurl and the curl command line tool when Negotiate authentication is used with ambient credentials provided by SSPI or GSSAPI.


8) Use-after-free (CVE-ID: CVE-2026-18924)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to use-after-free in libcurl HTTP/2 server push stream handling when processing an HTTPS HTTP/2 server push on a shared connection. A remote attacker can send a server push response sequence to trigger a use-after-free.

The issue affects libcurl only and requires HTTP/2 server push to be enabled and accepted by the application, along with connection sharing.


9) Improper restriction of communication channel to intended endpoints (CVE-ID: CVE-2026-13608)

CWE-ID: CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass LDAP server authentication.

The vulnerability exists due to improper restriction of communication channel to intended endpoints in the libcurl SASL negotiation for LDAP authentication when processing an incomplete OpenLDAP SASL handshake sequence. A remote attacker can inject a premature or shortcut response to bypass LDAP server authentication.

The issue only occurs when the OpenLDAP backend is used, and LDAPS is not affected.


Remediation

Install update from vendor's website.

References