CVE-2026-9547 | High | 7.4 | 2026-07-03 | When a libcurl-based application performs transfers via `SCP://` or `SFTP://`
and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an
un… |
CVE-2026-9546 | High | 7.5 | 2026-07-03 | A vulnerability in libcurl caused the HTTP `Referer:` header to persist even
when explicitly cleared. While the documentation states that passing NULL to
`CURL… |
CVE-2026-9545 | High | 7.5 | 2026-07-03 | In this scenario, libcurl first uses a proper HTTP/3 server for the initial
transfers, and when it makes a second transfer to the same site it has been
replace… |
CVE-2026-9080 | High | 7.3 | 2026-07-03 | Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`
callback triggers a use-after-free vulnerability, where libcurl attempts to
store… |
CVE-2026-9079 | Critical | 9.8 | 2026-07-03 | libcurl had a flaw that when instructed to clear proxy authentication
credentials which made it not do so, leaving the old credentials around to get
used for s… |
CVE-2026-8932 | High | 7.5 | 2026-07-03 | libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.
libcurl keep… |
CVE-2026-8927 | Critical | 9.1 | 2026-07-03 | When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication stat… |
CVE-2026-8926 | Critical | 9.1 | 2026-07-03 | When asking curl to use a `.netrc` file to find credentials and at the same
time specifying a URL with a username(without a password), like
`https://user@examp… |
CVE-2026-8925 | Critical | 9.8 | 2026-07-03 | The curl logic that works with SASL authentication could end up cleaning up
the GSASL context *twice* without clearing the pointer in between, making it
`free(… |
CVE-2026-8924 | Critical | 9.1 | 2026-07-03 | A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
'super cookies' that bypass the Public Suffix List check. This enables an
attacker-… |
CVE-2026-8458 | Medium | 6.5 | 2026-07-03 | libcurl might in some circumstances reuse the wrong connection when asked to
do Negotiate-authenticated ones, even when they are set to use different
'services… |
CVE-2026-8286 | High | 8.1 | 2026-07-03 | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the
connection might reuse an existing live connection even though the TLS
configurat… |
CVE-2026-12064 | High | 7.5 | 2026-07-03 | When a user invokes curl using a schemeless URL combined with
`--proto-default` sftp (or scp), a disconnect occurs between the tool layer
and libcurl. The tool… |
CVE-2026-11856 | Critical | 9.8 | 2026-07-03 | Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one… |
CVE-2026-11586 | High | 7.5 | 2026-07-03 | By default, curl automatically responds to WebSocket PING frames. Because curl
lacks an upper bound on memory allocation for unacknowledged frames, a
malicious… |
CVE-2026-11564 | Critical | 9.1 | 2026-07-03 | libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup.
An easy handle that first u… |
CVE-2026-11352 | High | 7.5 | 2026-07-03 | An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server
to trigger a remote denial of service against a curl or libcurl client.
Because t… |
CVE-2026-10536 | Critical | 9.8 | 2026-07-03 | A use-after-free vulnerability exists in libcurl when an application
configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or
`CURLOPT_STREA… |
CVE-2026-7168 | Medium | 5.3 | 2026-05-13 | Successfully using libcurl to do a transfer over a specific HTTP proxy
(`proxyA`) with **Digest** authentication and then changing the proxy host to
a second o… |
CVE-2026-7009 | Medium | 5.3 | 2026-05-13 | When curl is told to use the Certificate Status Request TLS extension, often
referred to as *OCSP stapling*, to verify that the server certificate is
valid, it… |
CVE-2026-6429 | Medium | 5.3 | 2026-05-13 | When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, libcurl could leak the password used for the first host to the
followed-to… |
CVE-2026-6276 | High | 7.5 | 2026-05-13 | Using libcurl, when a custom `Host:` header is first set for an HTTP request
and a second request is subsequently done using the same *easy handle* but
without… |
CVE-2026-6253 | Medium | 5.9 | 2026-05-13 | curl might erroneously pass on credentials for a first proxy to a second
proxy.
This can happen when the following conditions are true:
1. curl is setup to u… |
CVE-2026-5773 | High | 7.5 | 2026-05-13 | libcurl might in some circumstances reuse the wrong connection for SMB(S)
transfers.
libcurl features a pool of recent connections so that subsequent requests… |
CVE-2026-5545 | Medium | 6.5 | 2026-05-13 | libcurl might in some circumstances reuse the wrong connection when asked to
do an authenticated HTTP(S) request after a Negotiate-authenticated one, when
both… |
CVE-2026-4873 | Medium | 5.9 | 2026-05-13 | A vulnerability exists where a connection requiring TLS incorrectly reuses an
existing unencrypted connection from the same connection pool. If an initial
tran… |
CVE-2026-3805 | High | 7.5 | 2026-03-11 | When doing a second SMB request to the same host again, curl would wrongly use
a data pointer pointing into already freed memory. |
CVE-2026-3784 | Medium | 6.5 | 2026-03-11 | curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a
server, even if the new request uses different credentials for the HTTP proxy.
Th… |
CVE-2026-3783 | Medium | 5.3 | 2026-03-11 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer
performs a redirect to a second URL, curl could leak that token to the second
ho… |
CVE-2026-1965 | Medium | 6.5 | 2026-03-11 | libcurl can in some circumstances reuse the wrong connection when asked to do
an Negotiate-authenticated HTTP or HTTPS request.
libcurl features a pool of rec… |
CVE-2025-11563 | Medium | 4.6 | 2026-02-25 | URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into
saving the output file outside of the current directory without the user
explicitly a… |
CVE-2025-15224 | Low | 3.1 | 2026-01-08 | When doing SSH-based transfers using either SCP or SFTP, and asked to do
public key authentication, curl would wrongly still ask and authenticate using
a local… |
CVE-2025-15079 | Medium | 5.3 | 2026-01-08 | When doing SSH-based transfers using either SCP or SFTP, and setting the
known_hosts file, libcurl could still mistakenly accept connecting to hosts
*not prese… |
CVE-2025-14819 | Medium | 5.3 | 2026-01-08 | When doing TLS related transfers with reused easy or multi handles and
altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally
reuse a CA… |
CVE-2025-14524 | Medium | 5.3 | 2026-01-08 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer
performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,
POP3… |
CVE-2025-14017 | Medium | 6.3 | 2026-01-08 | When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,
changing TLS options in one thread would inadvertently change them globally
and therefo… |
CVE-2025-13034 | Medium | 5.9 | 2026-01-08 | When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`
with the curl tool,curl should check the public key of the server certificate
to v… |
CVE-2025-10966 | Medium | 4.3 | 2025-11-07 | curl's code for managing SSH connections when SFTP was done using the wolfSSH
powered backend was flawed and missed host verification mechanisms.
This prevent… |
CVE-2025-9086 | High | 7.5 | 2025-09-12 | 1. A cookie is set using the `secure` keyword for `https://target`
2. curl is redirected to or otherwise made to speak with `http://target` (same
hostnam… |
CVE-2025-10148 | Medium | 5.3 | 2025-09-12 | curl's websocket code did not update the 32 bit mask pattern for each new
outgoing frame as the specification says. Instead it used a fixed mask that
persiste… |
CVE-2025-5399 | High | 7.5 | 2025-06-07 | Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
busy-loop… |
CVE-2025-5025 | Medium | 4.8 | 2025-05-28 | libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC… |
CVE-2025-4947 | Medium | 6.5 | 2025-05-28 | libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it doe… |
CVE-2025-0725 | High | 7.3 | 2025-02-05 | When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
**using zlib 1.2.0.3… |
CVE-2025-0665 | High | 7.0 | 2025-02-05 | libcurl would wrongly close the same eventfd file descriptor twice when taking
down a connection channel after having completed a threaded name resolve. |
CVE-2025-0167 | Low | 3.4 | 2025-02-05 | When asked to use a `.netrc` file for credentials **and** to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to hos… |
CVE-2024-11053 | Low | 3.4 | 2024-12-11 | When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to ho… |
CVE-2024-9681 | Medium | 6.5 | 2024-11-06 | When curl is asked to use HSTS, the expiry time for a subdomain might
overwrite a parent domain's cache entry, making it end sooner or later than
otherwise int… |
CVE-2024-8096 | Medium | 6.5 | 2024-09-11 | When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it m… |
CVE-2024-7264 | Medium | 6.5 | 2024-07-31 | libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an
ASN.1 Generalized Time field. If given an syntactically incorrect field, the
par… |
CVE-2024-6874 | Medium | 4.3 | 2024-07-24 | libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name… |
CVE-2024-6197 | High | 7.5 | 2024-07-24 | libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, wh… |
CVE-2024-2466 | Medium | 6.5 | 2024-03-27 | libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly av… |
CVE-2024-2398 | High | 8.6 | 2024-03-27 | When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (10… |
CVE-2024-2379 | Medium | 6.3 | 2024-03-27 | libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or c… |
CVE-2024-2004 | Low | 3.5 | 2024-03-27 | When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to a… |
CVE-2024-0853 | Medium | 5.3 | 2024-02-03 | curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to
the… |
CVE-2023-46219 | Medium | 5.3 | 2023-12-12 | When saving HSTS data to an excessively long file name, curl could end up
removing all contents, making subsequent requests using that file unaware of
the HSTS… |
CVE-2023-46218 | Medium | 6.5 | 2023-12-07 | This flaw allows a malicious HTTP server to set "super cookies" in curl that
are then passed back to more origins than what is otherwise allowed or
possible. T… |
CVE-2023-38546 | Low | 3.7 | 2023-10-18 | This flaw allows an attacker to insert cookies at will into a running program
using libcurl, if the specific series of conditions are met.
libcurl performs tr… |
CVE-2023-38545 | Critical | 9.8 | 2023-10-18 | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
handshake.
When curl is asked to pass along the host name to the SOCKS5 proxy to allow
t… |
CVE-2023-38039 | High | 7.5 | 2023-09-15 | When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API.
However, curl did not hav… |
CVE-2019-5436 | High | 7.8 | 2019-05-28 | A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. |
CVE-2019-5435 | Low | 3.7 | 2019-05-28 | An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. |
CVE-2017-2629 | Medium | 4.3 | 2018-07-27 | curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the… |
CVE-2012-0036 | | | 2012-04-13 | curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to co… |
CVE-2010-3842 | | | 2010-10-28 | Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or ove… |
CVE-2010-0734 | | | 2010-03-19 | content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that r… |
CVE-2009-2417 | | | 2009-08-14 | lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common N… |
CVE-2009-0037 | | | 2009-03-05 | The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might all… |
CVE-2005-3185 | | | 2005-10-13 | Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use… |