Vulnerability-Lookup

CVE-2026-107929 (GCVE-0-2026-107929)

Vulnerability from cvelistv5 – Published: 2026-10-20 20:29 – Updated: 2026-10-20 20:29

Title

local interface connection reuse mixup

Summary

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address

Severity

No CVSS data available.

CWE

CWE-488 Exposure of Data Element to Wrong Session

Assigner

curl CNA under the redhat root

CNA scorecard D 46/100 over 59 records in the last 180 days details

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-107929.json
https://curl.se/docs/CVE-2026-107929.html
https://hackerone.com/reports/4099618

Impacted products

1 product

Vendor	Product	Version	CPE status
curl	curl	Affected: 8.22.0 , ≤ 8.22.0 (semver) Affected: 8.21.0 , ≤ 8.21.0 (semver) Affected: 8.20.0 , ≤ 8.20.0 (semver) Affected: 8.19.0 , ≤ 8.19.0 (semver) Affected: 8.18.0 , ≤ 8.18.0 (semver) Affected: 8.17.0 , ≤ 8.17.0 (semver) Affected: 8.16.0 , ≤ 8.16.0 (semver) Affected: 8.15.0 , ≤ 8.15.0 (semver) Affected: 8.14.1 , ≤ 8.14.1 (semver) Affected: 8.14.0 , ≤ 8.14.0 (semver) Affected: 8.13.0 , ≤ 8.13.0 (semver) Affected: 8.12.1 , ≤ 8.12.1 (semver) Affected: 8.12.0 , ≤ 8.12.0 (semver) Affected: 8.11.1 , ≤ 8.11.1 (semver) Affected: 8.11.0 , ≤ 8.11.0 (semver) Affected: 8.10.1 , ≤ 8.10.1 (semver) Affected: 8.10.0 , ≤ 8.10.0 (semver) Affected: 8.9.1 , ≤ 8.9.1 (semver) Affected: 8.9.0 , ≤ 8.9.0 (semver)	guessed

Credits

Maksim Hayder Stefan Eissing

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.22.0",
              "status": "affected",
              "version": "8.22.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.21.0",
              "status": "affected",
              "version": "8.21.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.20.0",
              "status": "affected",
              "version": "8.20.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19.0",
              "status": "affected",
              "version": "8.19.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.18.0",
              "status": "affected",
              "version": "8.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.17.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.16.0",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.15.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.1",
              "status": "affected",
              "version": "8.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.0",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.13.0",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.1",
              "status": "affected",
              "version": "8.12.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0",
              "status": "affected",
              "version": "8.12.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.1",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.0",
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.1",
              "status": "affected",
              "version": "8.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.1",
              "status": "affected",
              "version": "8.9.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.0",
              "status": "affected",
              "version": "8.9.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Maksim Hayder"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stefan Eissing"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When `CURLOPT_INTERFACE` (or the command line tool\u0027s `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer\u0027s source address"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-488 Exposure of Data Element to Wrong Session",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T20:29:28.177Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "name": "json",
          "url": "https://curl.se/docs/CVE-2026-107929.json"
        },
        {
          "name": "www",
          "url": "https://curl.se/docs/CVE-2026-107929.html"
        },
        {
          "name": "issue",
          "url": "https://hackerone.com/reports/4099618"
        }
      ],
      "title": "local interface connection reuse mixup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-107929",
    "datePublished": "2026-10-20T20:29:28.177Z",
    "dateReserved": "2026-10-09T07:51:38.463Z",
    "dateUpdated": "2026-10-20T20:29:28.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-107929",
      "date": "2026-10-21",
      "epss": "0.00291",
      "percentile": "0.20439"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThanOrEqual": "8.22.0",
                    "status": "affected",
                    "version": "8.22.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.21.0",
                    "status": "affected",
                    "version": "8.21.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.20.0",
                    "status": "affected",
                    "version": "8.20.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.19.0",
                    "status": "affected",
                    "version": "8.19.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.18.0",
                    "status": "affected",
                    "version": "8.18.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.17.0",
                    "status": "affected",
                    "version": "8.17.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.16.0",
                    "status": "affected",
                    "version": "8.16.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.15.0",
                    "status": "affected",
                    "version": "8.15.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.14.1",
                    "status": "affected",
                    "version": "8.14.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.14.0",
                    "status": "affected",
                    "version": "8.14.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.13.0",
                    "status": "affected",
                    "version": "8.13.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.12.1",
                    "status": "affected",
                    "version": "8.12.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.12.0",
                    "status": "affected",
                    "version": "8.12.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.11.1",
                    "status": "affected",
                    "version": "8.11.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.11.0",
                    "status": "affected",
                    "version": "8.11.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.10.1",
                    "status": "affected",
                    "version": "8.10.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.10.0",
                    "status": "affected",
                    "version": "8.10.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.9.1",
                    "status": "affected",
                    "version": "8.9.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.9.0",
                    "status": "affected",
                    "version": "8.9.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "When `CURLOPT_INTERFACE` (or the command line tool\u0027s `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer\u0027s source address"
          }
        ],
        "id": "CVE-2026-107929",
        "lastModified": "2026-10-20T21:17:15.593",
        "metrics": {},
        "published": "2026-10-20T21:17:15.593",
        "references": [
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://curl.se/docs/CVE-2026-107929.html"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://curl.se/docs/CVE-2026-107929.json"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://hackerone.com/reports/4099618"
          }
        ],
        "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "vulnStatus": "Received"
      }
    }
  }
}

CERTFR-2026-AVI-1307

Vulnerability from certfr_avis - Published: 2026-10-14 - Updated: 2026-10-14

De multiples vulnérabilités ont été découvertes dans Curl. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Curl	cURL et libcurl	Curl versions antérieures à 8.23.0

References

Title

Publication Time

Tags

Bulletin de sécurité Curl CVE-2026-86412	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-107928	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92388	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92386	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86411	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-94265	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87862	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86410	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-107929	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92387	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87864	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87865	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86414	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92392	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87866	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92389	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86409	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92391	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86413	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86415	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-94266	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87863	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87861	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92390	2026-10-14	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Curl versions ant\u00e9rieures \u00e0 8.23.0",
      "product": {
        "name": "cURL et libcurl",
        "vendor": {
          "name": "Curl",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-94265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94265"
    },
    {
      "name": "CVE-2026-87863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87863"
    },
    {
      "name": "CVE-2026-107928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107928"
    },
    {
      "name": "CVE-2026-86414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86414"
    },
    {
      "name": "CVE-2026-86411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86411"
    },
    {
      "name": "CVE-2026-87864",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87864"
    },
    {
      "name": "CVE-2020-8177",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8177"
    },
    {
      "name": "CVE-2026-92392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92392"
    },
    {
      "name": "CVE-2026-86413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86413"
    },
    {
      "name": "CVE-2026-107929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107929"
    },
    {
      "name": "CVE-2026-92389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92389"
    },
    {
      "name": "CVE-2026-87861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87861"
    },
    {
      "name": "CVE-2026-92386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92386"
    },
    {
      "name": "CVE-2026-92387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92387"
    },
    {
      "name": "CVE-2026-12064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12064"
    },
    {
      "name": "CVE-2026-92391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92391"
    },
    {
      "name": "CVE-2026-86410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86410"
    },
    {
      "name": "CVE-2026-86415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86415"
    },
    {
      "name": "CVE-2026-87865",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87865"
    },
    {
      "name": "CVE-2026-87862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87862"
    },
    {
      "name": "CVE-2026-94266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94266"
    },
    {
      "name": "CVE-2026-92388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92388"
    },
    {
      "name": "CVE-2026-86412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86412"
    },
    {
      "name": "CVE-2026-87866",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87866"
    },
    {
      "name": "CVE-2026-92390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92390"
    },
    {
      "name": "CVE-2026-86409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86409"
    }
  ],
  "initial_release_date": "2026-10-14T00:00:00",
  "last_revision_date": "2026-10-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1307",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Curl. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Curl",
  "vendor_advisories": [
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86412",
      "url": "https://curl.se/docs/CVE-2026-86412.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-107928",
      "url": "https://curl.se/docs/CVE-2026-107928.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92388",
      "url": "https://curl.se/docs/CVE-2026-92388.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92386",
      "url": "https://curl.se/docs/CVE-2026-92386.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86411",
      "url": "https://curl.se/docs/CVE-2026-86411.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-94265",
      "url": "https://curl.se/docs/CVE-2026-94265.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87862",
      "url": "https://curl.se/docs/CVE-2026-87862.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86410",
      "url": "https://curl.se/docs/CVE-2026-86410.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-107929",
      "url": "https://curl.se/docs/CVE-2026-107929.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92387",
      "url": "https://curl.se/docs/CVE-2026-92387.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87864",
      "url": "https://curl.se/docs/CVE-2026-87864.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87865",
      "url": "https://curl.se/docs/CVE-2026-87865.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86414",
      "url": "https://curl.se/docs/CVE-2026-86414.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92392",
      "url": "https://curl.se/docs/CVE-2026-92392.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87866",
      "url": "https://curl.se/docs/CVE-2026-87866.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92389",
      "url": "https://curl.se/docs/CVE-2026-92389.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86409",
      "url": "https://curl.se/docs/CVE-2026-86409.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92391",
      "url": "https://curl.se/docs/CVE-2026-92391.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86413",
      "url": "https://curl.se/docs/CVE-2026-86413.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86415",
      "url": "https://curl.se/docs/CVE-2026-86415.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-94266",
      "url": "https://curl.se/docs/CVE-2026-94266.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87863",
      "url": "https://curl.se/docs/CVE-2026-87863.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87861",
      "url": "https://curl.se/docs/CVE-2026-87861.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92390",
      "url": "https://curl.se/docs/CVE-2026-92390.html"
    }
  ]
}

FKIE_CVE-2026-107929

Vulnerability from fkie_nvd - Published: 2026-10-20 21:17 - Updated: 2026-10-20 21:17

Severity

Summary

References

	URL	Tags
	2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2026-107929.html
	2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2026-107929.json
	2499f714-1537-4658-8207-48ae4bb9eae9	https://hackerone.com/reports/4099618

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.22.0",
              "status": "affected",
              "version": "8.22.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.21.0",
              "status": "affected",
              "version": "8.21.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.20.0",
              "status": "affected",
              "version": "8.20.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19.0",
              "status": "affected",
              "version": "8.19.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.18.0",
              "status": "affected",
              "version": "8.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.17.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.16.0",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.15.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.1",
              "status": "affected",
              "version": "8.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.0",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.13.0",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.1",
              "status": "affected",
              "version": "8.12.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0",
              "status": "affected",
              "version": "8.12.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.1",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.0",
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.1",
              "status": "affected",
              "version": "8.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.1",
              "status": "affected",
              "version": "8.9.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.0",
              "status": "affected",
              "version": "8.9.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When `CURLOPT_INTERFACE` (or the command line tool\u0027s `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer\u0027s source address"
    }
  ],
  "id": "CVE-2026-107929",
  "lastModified": "2026-10-20T21:17:15.593",
  "metrics": {},
  "published": "2026-10-20T21:17:15.593",
  "references": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://curl.se/docs/CVE-2026-107929.html"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://curl.se/docs/CVE-2026-107929.json"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://hackerone.com/reports/4099618"
    }
  ],
  "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
  "vulnStatus": "Received"
}

GHSA-9644-8JHV-GXGM

Vulnerability from github – Published: 2026-10-20 21:31 – Updated: 2026-10-20 21:31

Details

When CURLOPT_INTERFACE (or the command line tool's --interface option) is set with one of the documented prefixes (if!, host!, ifhost!), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-107929"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-20T21:17:15Z",
    "severity": null
  },
  "details": "When `CURLOPT_INTERFACE` (or the command line tool\u0027s `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer\u0027s source address",
  "id": "GHSA-9644-8jhv-gxgm",
  "modified": "2026-10-20T21:31:06Z",
  "published": "2026-10-20T21:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107929"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/4099618"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2026-107929.html"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2026-107929.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

OPENSUSE-SU-2026:12150-1

Vulnerability from csaf_opensuse - Published: 2026-10-16 00:00 - Updated: 2026-10-21 11:52

Summary

curl-8.23.0-1.1 on GA media

Severity

Moderate

Scope

23 vulnerabilities in this advisory, including CVE-2026-107929.

CVE-2026-107929

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Recommended: 36 products

Open the full advisory

RHSA-2026:82895

Vulnerability from csaf_redhat - Published: 2026-10-14 11:39 - Updated: 2026-10-17 12:55

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

26 vulnerabilities in this advisory, including CVE-2026-107929.

CVE-2026-107929

A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in an application using pooled connections can cause subsequent transfers to inadvertently reuse an existing connection. This behavior causes outbound network traffic to be transmitted through the wrong source address, potentially routing requests through an unintended network interface.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 13 products

https://access.redhat.com/errata/RHSA-2026:82895

Open the full advisory

UBUNTU-CVE-2026-107929 (CVE-2026-107929)

Vulnerability from osv_ubuntu – Published: 2026-10-14 06:00 – Updated: 2026-10-19 20:40 – Source website

Details

Severity

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2026-107929	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-107929	REPORT
	https://curl.se/docs/CVE-2026-107929.html	REPORT
	https://ubuntu.com/security/notices/USN-8927-1	ADVISORY
	https://ubuntu.com/security/notices/USN-8927-2	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.20.0-2ubuntu11.1"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.20.0-2ubuntu11.1"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.20.0-2ubuntu11.1"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.20.0-2ubuntu11.1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.20.0-2ubuntu11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.18.0-1ubuntu2",
        "8.20.0-2ubuntu1",
        "8.20.0-2ubuntu3",
        "8.20.0-2ubuntu10",
        "8.20.0-2ubuntu11"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.18.0-1ubuntu2.8"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.18.0-1ubuntu2.8"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.18.0-1ubuntu2.8"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.18.0-1ubuntu2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.14.1-2ubuntu1",
        "8.17.0-1ubuntu1",
        "8.18.0-1ubuntu1",
        "8.18.0-1ubuntu2",
        "8.18.0-1ubuntu2.1",
        "8.18.0-1ubuntu2.2",
        "8.18.0-1ubuntu2.3",
        "8.18.0-1ubuntu2.4",
        "8.18.0-1ubuntu2.5",
        "8.18.0-1ubuntu2.7"
      ]
    }
  ],
  "aliases": [],
  "details": "When `CURLOPT_INTERFACE` (or the command line tool\u0027s `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer\u0027s source address.",
  "id": "UBUNTU-CVE-2026-107929",
  "modified": "2026-10-19T20:40:07Z",
  "published": "2026-10-14T06:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-107929"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107929"
    },
    {
      "type": "REPORT",
      "url": "https://curl.se/docs/CVE-2026-107929.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8927-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8927-2"
    }
  ],
  "related": [
    "USN-8927-1",
    "USN-8927-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-107929"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-107929 (GCVE-0-2026-107929)

CERTFR-2026-AVI-1307

Solutions

FKIE_CVE-2026-107929

GHSA-9644-8JHV-GXGM

OPENSUSE-SU-2026:12150-1

RHSA-2026:82895

UBUNTU-CVE-2026-107929 (CVE-2026-107929)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour