SB2026101438 - Multiple vulnerabilities in cURL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101438

SB2026101438 - Multiple vulnerabilities in cURL

Published: October 14, 2026

Security Bulletin ID SB2026101438
CSH Severity
High
Patch available
YES
Number of vulnerabilities 21
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 5% Medium 33% Low 62%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 21 vulnerabilities.


1) Improper Certificate Validation (CVE-ID: CVE-2026-87865)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain SSH credentials and supply attacker-controlled SFTP data.

The vulnerability exists due to incorrect classification of mismatched SSH host keys in libcurl's host key validation callback handling when validating host keys against a hashed known_hosts file containing an unrelated initial entry. A remote attacker can control or intercept the reached SSH endpoint and make an already pinned host appear new to a trust-on-first-use callback to obtain SSH credentials and supply attacker-controlled SFTP data.

Only libcurl builds using the libssh2 backend for SFTP and SCP transfers are affected. The default callback and curl command-line tool are not claimed affected.


2) Out-of-bounds read (CVE-ID: CVE-2026-107928)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in curl's WebSocket upload handling with GnuTLS when gnutls_record_send() reports more bytes sent than it was given to send following a blocked send. A remote attacker can operate a malicious WebSocket server to disclose sensitive information or cause a denial of service.

Exploitation requires a TLS send to encounter EAGAIN followed by an automated WebSocket PONG response.


3) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-107929)

CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause transfers to use an unintended source address.

The vulnerability exists due to omission of source bindings from the connection reuse key in curl's connection reuse logic when processing transfers configured through CURLOPT_INTERFACE or --interface with the if!, host!, or ifhost! prefixes. A local user can initiate a later transfer requesting a different source that silently reuses an existing connection to cause transfers to use an unintended source address.


4) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-86410)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass SSH host verification.

The vulnerability exists due to improper initialization of SSH host verification options in the curl command-line tool when following redirects from HTTPS to SFTP or SCP. A remote attacker can return a redirect to an SFTP or SCP destination to bypass SSH host verification.

Exploitation requires redirect following and redirects to SFTP or SCP to be enabled. The requested verification methods specified through --knownhosts, --hostpubsha256, or --hostpubmd5 are not applied to the redirected connection. libcurl is not affected.


5) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-86412)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to delete cookies for unrelated domains and cause a denial of service.

The vulnerability exists due to improper handling of exceptional cookie size conditions in curl's cookie jar loading and cleanup procedures when reloading a stored cookie that exceeds the cookie file line limit. A remote attacker can serve a specially crafted HTTP cookie that curl accepts and stores but subsequently refuses to reload to delete cookies for unrelated domains and cause a denial of service.

Exploitation requires a subsequent curl invocation using the same file path for --cookie and --cookie-jar. That invocation fails before connecting, and cleanup replaces the cookie jar with an empty file.


6) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86413)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose Negotiate authentication credentials to an unrelated origin.

The vulnerability exists due to improper restriction of credential forwarding in curl's Negotiate authentication handling when following redirects. A remote attacker can cause a redirect to an unrelated origin using a URL containing a username and password to disclose Negotiate authentication credentials to an unrelated origin.

Exploitation requires an ambient user, configured by supplying a blank username so that curl uses credentials provided by the Kerberos system. The issue only triggers when usernames in URLs are permitted.


7) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86414)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose origin credentials.

The vulnerability exists due to incorrect handling of origin authentication challenges in libcurl's HTTP proxy tunnel handling when processing responses to CONNECT requests. A remote attacker can return an HTTP 401 response with a WWW-Authenticate header instead of the expected HTTP 407 response with a Proxy-Authenticate header to disclose origin credentials.

Exploitation requires the client to use an attacker-controlled HTTP proxy. Exposed credentials can include a Basic authentication password or a Negotiate/Kerberos ticket.


8) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86415)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to failure to account for the automatic client certificate option in libcurl's connection cache matcher when matching cached connections for transfers redirected to a different origin. A remote attacker can exploit reuse of an already authenticated cached connection despite automatic client certificate selection being disabled for the redirected transfer to disclose sensitive information.

Only builds using the Schannel TLS backend, which is available only on Windows, are affected.


9) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-87861)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper isolation of authenticated connections between origins in curl's HTTP connection reuse logic when sending HTTP requests using ambient user credentials. A remote attacker can exploit reuse of a connection previously authenticated via Negotiate for a different origin to disclose sensitive information.

Ambient credentials are used when a blank user name is provided and the actual identity and credentials are managed outside curl.


10) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-87862)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain information sent over unencrypted HTTP.

The vulnerability exists due to incorrect discarding of longer-lived child HSTS entries in curl's HSTS cache import functionality when importing an includeSubDomains parent entry before a longer-lived child entry. A remote attacker can take advantage of the loss of HTTPS enforcement after the parent entry expires to obtain information sent over unencrypted HTTP.


11) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-87863)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to erase persisted HSTS cache entries.

The vulnerability exists due to improper handling of time serialization failures in HSTS cache persistence when saving entries received from an authenticated HTTPS origin. A remote user can supply an HSTS max-age value that the parser accepts but time serialization cannot process to erase persisted HSTS cache entries.

On 64-bit systems, extreme max-age values can produce expiry times within time integer limits but beyond calendar time structure bounds. Cache save errors are silently ignored during cleanup, allowing curl to exit successfully.


12) Insufficiently protected credentials (CVE-ID: CVE-2026-94266)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to obtain sensitive credentials.

The vulnerability exists due to insufficient protection of credentials in the curl_easy_getinfo CURLINFO_EFFECTIVE_URL option when retrieving credentials from a .netrc file. A local user can read credentials exposed in the returned effective URL to obtain sensitive credentials.

Credentials can appear even when neither the original URL nor the redirected URL contains them. The curl command-line option --write-out '%{url_effective}' exposes the same information.


13) Improper Certificate Validation (CVE-ID: CVE-2026-87866)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass public-key pinning.

The vulnerability exists due to improper certificate validation in libcurl's public-key pinning certificate parser when re-parsing a TLS peer certificate after the handshake. A remote attacker can present a malformed certificate with a manipulated validity length field to bypass public-key pinning.

Exploitation requires libcurl to be built with wolfSSL and relies on a wolfSSL bug that accepts the malformed certificate. The curl command-line tool is not affected.


14) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-92386)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to prematurely terminate cookie jar parsing, causing subsequent valid cookies to be ignored.

The vulnerability exists due to improper validation of cookie record length in the Netscape cookie jar writer and parser when writing server-supplied cookies and subsequently loading the cookie jar. A remote attacker can supply a long cookie name and value through an HTTP server response to prematurely terminate cookie jar parsing, causing subsequent valid cookies to be ignored.

Exploitation requires a subsequent invocation to read the same cookie jar using --cookie. The server cannot determine or control the cookie's relative position in the jar, so the oversized record may affect many, few, or no other cookies.


15) Infinite loop (CVE-ID: CVE-2026-92387)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in libcurl's FTP, IMAP, POP3, and SMTP control-response handling when processing server responses. A remote attacker can permanently omit the final control-response line to cause a denial of service by bypassing configured transfer timeouts and indefinitely blocking all concurrent transfers bound to the same multi-handle.

Sustaining the loop requires the server to feed data at the client's read speed, requiring a very high network speed or an unusually slow client. The curl command-line tool is not affected.


16) Use-after-free (CVE-ID: CVE-2026-92388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service and corrupt memory.

The vulnerability exists due to use-after-free and type confusion in libcurl's FTP wildcard write callback handling when reusing or cloning an easy handle after a failed FTP wildcard LIST operation. A remote attacker can supply server response bytes that are processed through the incorrectly retained internal listing parser to cause a denial of service and corrupt memory.

Exploitation requires CURLOPT_FTP_WILDCARD to be enabled. The use-after-free read occurs when the original handle is freed before a transfer executes on its duplicate. Type confusion occurs when the application changes CURLOPT_WRITEDATA without also changing CURLOPT_WRITEFUNCTION. The curl command-line tool is not affected.


17) Information disclosure (CVE-ID: CVE-2026-92389)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper validation of state transitions against the requested transfer direction in libcurl's TFTP state machine when handling opening server responses to download requests. A remote attacker can send a specially crafted server response that forces the client into transmit mode to disclose sensitive information.

Data is consumed from the handle's persistent CURLOPT_READDATA pointer, which may retain data from unrelated prior operations, such as an HTTP POST request executed on a reused handle. The curl command-line tool is not affected.


18) External Control of File Name or Path (CVE-ID: CVE-2026-92390)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to overwrite existing local files.

The vulnerability exists due to failure to preserve anti-clobbering protection in the curl command line tool's HTTP response handling when processing responses with --remote-header-name (-J) enabled. A remote attacker can serve a response containing a Content-Disposition filename preceded by an intermediate 103 Early Hints response, or by an ETag header when --etag-save is enabled, to overwrite existing local files.

The flaw affects only the command line tool, not libcurl.


19) Uncontrolled Recursion (CVE-ID: CVE-2026-92391)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in libcurl's curl_mime_free function when traversing deeply nested multipart MIME structures during cleanup. A local user can construct a deeply nested multipart MIME structure through the public API to cause a denial of service.

Triggering the flaw requires thousands of nested MIME parts, with the exact threshold depending on the system and configuration. The curl command line tool is not affected.


20) Use-after-free (CVE-ID: CVE-2026-92392)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in curl's HTTP/2 upload handling when processing server-supplied stream resets during an upload. A remote attacker can send specially crafted HTTP/2 RST_STREAM frames with the HTTP_1_1_REQUIRED or REFUSED_STREAM reason to execute arbitrary code.

The demonstrated exploitation requires knowledge of the exact curl object layout, target architecture, compatible libc allocator and heap layout, and calibrated leak and symbol offsets. It also depends on nghttp2 and OpenSSL/TLS 1.3 allocation behavior, a pinned CA bundle and input-dependent allocation geometry, and the timing of two parallel transfers. The demonstrated exploit has an approximately 23-byte command constraint.


21) Information disclosure (CVE-ID: CVE-2026-94265)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose Kerberos tickets to an untrusted third-party host.

The vulnerability exists due to improper retention of authentication state in curl's HTTP Negotiate authentication handling when processing an HTTP redirect to a URL containing userinfo. A remote attacker can send a redirect containing arbitrary username and password information from a malicious server to disclose Kerberos tickets to an untrusted third-party host.

The ticket is generated using the ambient identity of the client process. Exploitation does not require the --location-trusted option to be enabled.


Remediation

Install update from vendor's website.

References