CVE-2026-9547 | High | 7.4 | 2026-07-03 | When a libcurl-based application performs transfers via `SCP://` or `SFTP://`
and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an
un… |
CVE-2026-9546 | High | 7.5 | 2026-07-03 | A vulnerability in libcurl caused the HTTP `Referer:` header to persist even
when explicitly cleared. While the documentation states that passing NULL to
`CURL… |
CVE-2026-9545 | High | 7.5 | 2026-07-03 | In this scenario, libcurl first uses a proper HTTP/3 server for the initial
transfers, and when it makes a second transfer to the same site it has been
replace… |
CVE-2026-9080 | High | 7.3 | 2026-07-03 | Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`
callback triggers a use-after-free vulnerability, where libcurl attempts to
store… |
CVE-2026-9079 | Critical | 9.8 | 2026-07-03 | libcurl had a flaw that when instructed to clear proxy authentication
credentials which made it not do so, leaving the old credentials around to get
used for s… |
CVE-2026-8932 | High | 7.5 | 2026-07-03 | libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.
libcurl keep… |
CVE-2026-8927 | Critical | 9.1 | 2026-07-03 | When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication stat… |
CVE-2026-8926 | Critical | 9.1 | 2026-07-03 | When asking curl to use a `.netrc` file to find credentials and at the same
time specifying a URL with a username(without a password), like
`https://user@examp… |
CVE-2026-8925 | Critical | 9.8 | 2026-07-03 | The curl logic that works with SASL authentication could end up cleaning up
the GSASL context *twice* without clearing the pointer in between, making it
`free(… |
CVE-2026-8924 | Critical | 9.1 | 2026-07-03 | A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
'super cookies' that bypass the Public Suffix List check. This enables an
attacker-… |
CVE-2026-8458 | Medium | 6.5 | 2026-07-03 | libcurl might in some circumstances reuse the wrong connection when asked to
do Negotiate-authenticated ones, even when they are set to use different
'services… |
CVE-2026-8286 | High | 8.1 | 2026-07-03 | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the
connection might reuse an existing live connection even though the TLS
configurat… |
CVE-2026-12064 | High | 7.5 | 2026-07-03 | When a user invokes curl using a schemeless URL combined with
`--proto-default` sftp (or scp), a disconnect occurs between the tool layer
and libcurl. The tool… |
CVE-2026-11856 | Critical | 9.8 | 2026-07-03 | Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one… |
CVE-2026-11586 | High | 7.5 | 2026-07-03 | By default, curl automatically responds to WebSocket PING frames. Because curl
lacks an upper bound on memory allocation for unacknowledged frames, a
malicious… |
CVE-2026-11564 | Critical | 9.1 | 2026-07-03 | libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup.
An easy handle that first u… |
CVE-2026-11352 | High | 7.5 | 2026-07-03 | An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server
to trigger a remote denial of service against a curl or libcurl client.
Because t… |
CVE-2026-10536 | Critical | 9.8 | 2026-07-03 | A use-after-free vulnerability exists in libcurl when an application
configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or
`CURLOPT_STREA… |
CVE-2026-7168 | Medium | 5.3 | 2026-05-13 | Successfully using libcurl to do a transfer over a specific HTTP proxy
(`proxyA`) with **Digest** authentication and then changing the proxy host to
a second o… |
CVE-2026-7009 | Medium | 5.3 | 2026-05-13 | When curl is told to use the Certificate Status Request TLS extension, often
referred to as *OCSP stapling*, to verify that the server certificate is
valid, it… |
CVE-2026-6429 | Medium | 5.3 | 2026-05-13 | When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, libcurl could leak the password used for the first host to the
followed-to… |
CVE-2026-6276 | High | 7.5 | 2026-05-13 | Using libcurl, when a custom `Host:` header is first set for an HTTP request
and a second request is subsequently done using the same *easy handle* but
without… |
CVE-2026-6253 | Medium | 5.9 | 2026-05-13 | curl might erroneously pass on credentials for a first proxy to a second
proxy.
This can happen when the following conditions are true:
1. curl is setup to u… |
CVE-2026-5773 | High | 7.5 | 2026-05-13 | libcurl might in some circumstances reuse the wrong connection for SMB(S)
transfers.
libcurl features a pool of recent connections so that subsequent requests… |
CVE-2026-5545 | Medium | 6.5 | 2026-05-13 | libcurl might in some circumstances reuse the wrong connection when asked to
do an authenticated HTTP(S) request after a Negotiate-authenticated one, when
both… |
CVE-2026-4873 | Medium | 5.9 | 2026-05-13 | A vulnerability exists where a connection requiring TLS incorrectly reuses an
existing unencrypted connection from the same connection pool. If an initial
tran… |
CVE-2026-3805 | High | 7.5 | 2026-03-11 | When doing a second SMB request to the same host again, curl would wrongly use
a data pointer pointing into already freed memory. |
CVE-2026-3784 | Medium | 6.5 | 2026-03-11 | curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a
server, even if the new request uses different credentials for the HTTP proxy.
Th… |
CVE-2026-3783 | Medium | 5.3 | 2026-03-11 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer
performs a redirect to a second URL, curl could leak that token to the second
ho… |
CVE-2026-1965 | Medium | 6.5 | 2026-03-11 | libcurl can in some circumstances reuse the wrong connection when asked to do
an Negotiate-authenticated HTTP or HTTPS request.
libcurl features a pool of rec… |
CVE-2025-11563 | Medium | 4.6 | 2026-02-25 | URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into
saving the output file outside of the current directory without the user
explicitly a… |
CVE-2025-15224 | Low | 3.1 | 2026-01-08 | When doing SSH-based transfers using either SCP or SFTP, and asked to do
public key authentication, curl would wrongly still ask and authenticate using
a local… |
CVE-2025-15079 | Medium | 5.3 | 2026-01-08 | When doing SSH-based transfers using either SCP or SFTP, and setting the
known_hosts file, libcurl could still mistakenly accept connecting to hosts
*not prese… |
CVE-2025-14819 | Medium | 5.3 | 2026-01-08 | When doing TLS related transfers with reused easy or multi handles and
altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally
reuse a CA… |
CVE-2025-14524 | Medium | 5.3 | 2026-01-08 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer
performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,
POP3… |
CVE-2025-14017 | Medium | 6.3 | 2026-01-08 | When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,
changing TLS options in one thread would inadvertently change them globally
and therefo… |
CVE-2025-13034 | Medium | 5.9 | 2026-01-08 | When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`
with the curl tool,curl should check the public key of the server certificate
to v… |
CVE-2025-10966 | Medium | 4.3 | 2025-11-07 | curl's code for managing SSH connections when SFTP was done using the wolfSSH
powered backend was flawed and missed host verification mechanisms.
This prevent… |
CVE-2025-9086 | High | 7.5 | 2025-09-12 | 1. A cookie is set using the `secure` keyword for `https://target`
2. curl is redirected to or otherwise made to speak with `http://target` (same
hostnam… |
CVE-2025-10148 | Medium | 5.3 | 2025-09-12 | curl's websocket code did not update the 32 bit mask pattern for each new
outgoing frame as the specification says. Instead it used a fixed mask that
persiste… |
CVE-2025-5399 | High | 7.5 | 2025-06-07 | Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
busy-loop… |
CVE-2025-5025 | Medium | 4.8 | 2025-05-28 | libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC… |
CVE-2025-4947 | Medium | 6.5 | 2025-05-28 | libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it doe… |
CVE-2025-0725 | High | 7.3 | 2025-02-05 | When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
**using zlib 1.2.0.3… |
CVE-2025-0665 | High | 7.0 | 2025-02-05 | libcurl would wrongly close the same eventfd file descriptor twice when taking
down a connection channel after having completed a threaded name resolve. |
CVE-2025-0167 | Low | 3.4 | 2025-02-05 | When asked to use a `.netrc` file for credentials **and** to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to hos… |
CVE-2024-11053 | Low | 3.4 | 2024-12-11 | When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to ho… |
CVE-2024-9681 | Medium | 6.5 | 2024-11-06 | When curl is asked to use HSTS, the expiry time for a subdomain might
overwrite a parent domain's cache entry, making it end sooner or later than
otherwise int… |
CVE-2024-8096 | Medium | 6.5 | 2024-09-11 | When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it m… |
CVE-2024-32928 | Medium | 5.9 | 2024-08-19 | The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle atta… |
CVE-2024-7264 | Medium | 6.5 | 2024-07-31 | libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an
ASN.1 Generalized Time field. If given an syntactically incorrect field, the
par… |
CVE-2024-6874 | Medium | 4.3 | 2024-07-24 | libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name… |
CVE-2024-6197 | High | 7.5 | 2024-07-24 | libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, wh… |
CVE-2024-2466 | Medium | 6.5 | 2024-03-27 | libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly av… |
CVE-2024-2398 | High | 8.6 | 2024-03-27 | When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (10… |
CVE-2024-2379 | Medium | 6.3 | 2024-03-27 | libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or c… |
CVE-2024-2004 | Low | 3.5 | 2024-03-27 | When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to a… |
CVE-2024-0853 | Medium | 5.3 | 2024-02-03 | curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to
the… |
CVE-2023-46219 | Medium | 5.3 | 2023-12-12 | When saving HSTS data to an excessively long file name, curl could end up
removing all contents, making subsequent requests using that file unaware of
the HSTS… |
CVE-2023-46218 | Medium | 6.5 | 2023-12-07 | This flaw allows a malicious HTTP server to set "super cookies" in curl that
are then passed back to more origins than what is otherwise allowed or
possible. T… |
CVE-2023-38546 | Low | 3.7 | 2023-10-18 | This flaw allows an attacker to insert cookies at will into a running program
using libcurl, if the specific series of conditions are met.
libcurl performs tr… |
CVE-2023-38545 | Critical | 9.8 | 2023-10-18 | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
handshake.
When curl is asked to pass along the host name to the SOCKS5 proxy to allow
t… |
CVE-2023-38039 | High | 7.5 | 2023-09-15 | When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API.
However, curl did not hav… |
CVE-2020-19909 | Low | 3.3 | 2023-08-22 | Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct securit… |
CVE-2023-28322 | Low | 3.7 | 2023-05-26 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNC… |
CVE-2023-28321 | Medium | 5.9 | 2023-05-26 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternativ… |
CVE-2023-28320 | Medium | 5.9 | 2023-05-26 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build tim… |
CVE-2023-28319 | High | 7.5 | 2023-05-26 | A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this… |
CVE-2023-27538 | Medium | 5.5 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH o… |
CVE-2023-27537 | Medium | 5.9 | 2023-03-30 | A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for… |
CVE-2023-27536 | Medium | 5.9 | 2023-03-30 | An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect… |
CVE-2023-27535 | Medium | 5.9 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subs… |
CVE-2023-27534 | High | 8.8 | 2023-03-30 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the fir… |
CVE-2023-27533 | High | 8.8 | 2023-03-30 | A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted use… |
CVE-2023-23916 | Medium | 6.5 | 2023-02-23 | An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that… |
CVE-2023-23915 | Medium | 6.5 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple… |
CVE-2023-23914 | Critical | 9.1 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are request… |
CVE-2022-43552 | Medium | 5.9 | 2023-02-09 | A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies ca… |
CVE-2022-43551 | High | 7.5 | 2022-12-23 | A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use… |
CVE-2022-35260 | Medium | 6.5 | 2022-12-05 | curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould f… |
CVE-2022-32221 | Critical | 9.8 | 2022-12-05 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIEL… |
CVE-2022-42915 | High | 8.1 | 2022-10-29 | curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote serve… |
CVE-2022-42916 | High | 7.5 | 2022-10-29 | In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directl… |
CVE-2022-35252 | Low | 3.7 | 2022-09-23 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver migh… |
CVE-2022-32208 | Medium | 5.9 | 2022-07-07 | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle at… |
CVE-2022-32207 | Critical | 9.8 | 2022-07-07 | When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporar… |
CVE-2022-32206 | Medium | 6.5 | 2022-07-07 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different alg… |
CVE-2022-32205 | Medium | 4.3 | 2022-07-07 | A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large a… |
CVE-2022-30115 | Medium | 4.3 | 2022-06-02 | Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. Thi… |
CVE-2022-27782 | High | 7.5 | 2022-06-02 | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previ… |
CVE-2022-27781 | High | 7.5 | 2022-06-02 | libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous fu… |
CVE-2022-27780 | High | 7.5 | 2022-06-02 | The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wron… |
CVE-2022-27779 | Medium | 5.3 | 2022-06-02 | libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cook… |
CVE-2022-27778 | High | 8.1 | 2022-06-02 | A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. |
CVE-2022-27776 | Medium | 6.5 | 2022-06-02 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host… |
CVE-2022-27775 | High | 7.5 | 2022-06-02 | An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a… |
CVE-2022-27774 | Medium | 5.7 | 2022-06-02 | An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract creden… |
CVE-2022-22576 | High | 8.1 | 2022-05-26 | An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properl… |
CVE-2021-22947 | Medium | 5.9 | 2021-09-29 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and sen… |
CVE-2021-22946 | High | 7.5 | 2021-09-29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command l… |