https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 08:30:47 +0000 https://db.gcve.eu/vuln/certfr-2026-avi-1307 certfr-2026-avi-1307 https://db.gcve.eu/vuln/certfr-2026-avi-1307 https://db.gcve.eu/vuln/fkie_cve-2026-87863 <p>An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.</p> <p>An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.</p> https://db.gcve.eu/vuln/fkie_cve-2026-87863 https://db.gcve.eu/vuln/ghsa-53q4-87wj-266h <p>An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.</p> <p>An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.</p> https://db.gcve.eu/vuln/ghsa-53q4-87wj-266h https://db.gcve.eu/vuln/opensuse-su-2026:12150-1 <p>curl-8.23.0-1.1 on GA media</p> <p>curl-8.23.0-1.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2026:12150-1 https://db.gcve.eu/vuln/rhsa-2026:82895 <p>curl: libcurl: Curl out of bounds read for cookie path curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers curl: libcurl: Improper certificate validation due to cached TLS settings reuse curl: curl: stale SigV4 headers sent unintended curl: curl: redirect to SFTP or SCP bypasses host verification curl: curl: FTP connection reuse inherits client-certificate curl: curl: server-set cookie erases cookie jar curl: curl: Negotiate credentials sent to redirected origin curl: curl: leaking host credentials to HTTP proxy curl: curl: cross-origin reuse of a Negotiate connection curl: curl: HSTS cache import drops longer-lived child curl: curl: Hsts Response Erases Persisted Entries curl: IMAP APPEND plus CRLF conversion command injection curl: curl: knownhost callback mismatches key as missing curl: curl: wolfSSL public-key pinning bypass curl: curl: server-set cookie aborts cookie jar load curl: curl: never-ending loop via server response omission curl: curl: FTP wildcard write callback mixup curl: curl: TFTP direction confusion curl: curl: -J no-clobber guarantee bypassed with 103 early hints curl: curl: curl_mime_free stack overflow by recursion curl: curl: HTTP/2 upload Use-After-Free curl: curl: Authorization: Negotiate sent to foreign origin curl: curl: password leak in CURLINFO_EFFECTIVE_URL curl: curl: info leak uploading over WebSockets with GnuTLS curl: curl: local interface connection reuse mixup</p> <p>curl: libcurl: Curl out of bounds read for cookie path curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers curl: libcurl: Improper certificate validation due to cached TLS settings reuse curl: curl: stale SigV4 headers sent unintended curl: curl: redirect to SFTP or SCP bypasses host verification curl: curl: FTP connection reuse inherits client-certificate curl: curl: server-set cookie erases cookie jar curl: curl: Negotiate credentials sent to redirected origin curl: curl: leaking host credentials to HTTP proxy curl: curl: cross-origin reuse of a Negotiate connection curl: curl: HSTS cache import drops longer-lived child curl: curl: Hsts Response Erases Persisted Entries curl: IMAP APPEND plus CRLF conversion command injection curl: curl: knownhost callback mismatches key as missing curl: curl: wolfSSL public-key pinning bypass curl: curl: server-set cookie aborts cookie jar load curl: curl: never-ending loop via server response omission curl: curl: FTP wildcard write callback mixup curl: curl: TFTP direction confusion curl: curl: -J no-clobber guarantee bypassed with 103 early hints curl: curl: curl_mime_free stack overflow by recursion curl: curl: HTTP/2 upload Use-After-Free curl: curl: Authorization: Negotiate sent to foreign origin curl: curl: password leak in CURLINFO_EFFECTIVE_URL curl: curl: info leak uploading over WebSockets with GnuTLS curl: curl: local interface connection reuse mixup</p> https://db.gcve.eu/vuln/rhsa-2026:82895 https://db.gcve.eu/vuln/ubuntu-cve-2026-87863 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: curl, Ubuntu:26.10: curl, Ubuntu:26.04:LTS: curl</p> <p>An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: curl, Ubuntu:26.10: curl, Ubuntu:26.04:LTS: curl</p> <p>An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-87863