Improper restriction of communication channel to intended endpoints in cURL - CVE-2026-13608

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU146685

Improper restriction of communication channel to intended endpoints in cURL - CVE-2026-13608

Published: September 2, 2026


Vulnerability identifier: #VU146685
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-13608
CWE-ID: CWE-923
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass LDAP server authentication.

The vulnerability exists due to improper restriction of communication channel to intended endpoints in the libcurl SASL negotiation for LDAP authentication when processing an incomplete OpenLDAP SASL handshake sequence. A remote attacker can inject a premature or shortcut response to bypass LDAP server authentication.

The issue only occurs when the OpenLDAP backend is used, and LDAPS is not affected.


Affected software

cURL
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Basesystem Module
openSUSE Leap
Ubuntu
Anolis OS
openEuler
Fedora
curl
curl-debuginfo
curl-debugsource
libcurl4-32bit
libcurl4-debuginfo-32bit
libcurl4-debuginfo
libcurl4
libcurl-devel
curl-doc
curl-minimal
libcurl
libcurl-minimal
curl-help
libcurl-mini4-debuginfo
libcurl4-64bit
libcurl-devel-64bit
libcurl4-64bit-debuginfo
libcurl-devel-doc
curl-zsh-completion
curl-fish-completion
curl-mini-debugsource
libcurl-mini4
libcurl4-32bit-debuginfo
libcurl-devel-32bit
curl (Ubuntu package)

How to mitigate CVE-2026-13608

Install security update from vendor's website.

cURL - update to 8.22.0
curl - addressed in versions 8.18.0-14.fc44, 8.15.0-12.fc43, 8.21.0-8.fc45
curl-debuginfo - addressed in versions 8.0.1-11.129.1, 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1, 8.14.1-150700.7.26.1
curl-debugsource - addressed in versions 8.0.1-11.129.1, 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1, 8.14.1-150700.7.26.1
libcurl4-32bit - addressed in versions 8.0.1-11.129.1, 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1, 8.14.1-150700.7.26.1
curl - addressed in versions 8.0.1-11.129.1, 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1, 8.14.1-150700.7.26.1
libcurl4-debuginfo-32bit - update to 8.0.1-11.129.1
libcurl4-debuginfo - addressed in versions 8.0.1-11.129.1, 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1, 8.14.1-150700.7.26.1
libcurl4 - addressed in versions 8.0.1-11.129.1, 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1, 8.14.1-150700.7.26.1
libcurl-devel - addressed in versions 8.0.1-11.129.1, 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1, 8.14.1-150700.7.26.1
curl-doc - update to 8.4.0-31
curl - update to 8.4.0-31
curl-minimal - update to 8.4.0-31
libcurl - update to 8.4.0-31
libcurl-devel - update to 8.4.0-31
libcurl-minimal - update to 8.4.0-31
curl-debuginfo - update to 8.4.0-37
curl - update to 8.4.0-37
libcurl-devel - update to 8.4.0-37
curl-help - update to 8.4.0-37
libcurl - update to 8.4.0-37
curl-debugsource - update to 8.4.0-37
libcurl-mini4-debuginfo - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1
libcurl4-64bit - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1
libcurl-devel-64bit - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1
libcurl4-64bit-debuginfo - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1
libcurl-devel-doc - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1
curl-zsh-completion - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1
curl-fish-completion - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1
curl-mini-debugsource - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1
libcurl-mini4 - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1
libcurl4-32bit-debuginfo - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1, 8.14.1-150700.7.26.1
libcurl-devel-32bit - addressed in versions 8.14.1-150400.5.91.1, 8.14.1-150600.4.51.1
curl (Ubuntu package) - addressed in versions 7.47.0-1ubuntu2.19+esm20, 7.58.0-2ubuntu3.24+esm14, 7.68.0-1ubuntu2.25+esm9, 7.81.0-1ubuntu1.29, 8.5.0-2ubuntu10.15, 8.18.0-1ubuntu2.7

External References

Related Security Bulletins