Vulnerability-Lookup

RHSA-2026:63161

Vulnerability from csaf_redhat - Published: 2026-09-03 12:06 - Updated: 2026-09-22 10:15

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: curl: * curl-8.22.0-0.1.hum1 (aarch64, x86_64) * libcurl-8.22.0-0.1.hum1 (aarch64, x86_64) * libcurl-devel-8.22.0-0.1.hum1 (aarch64, x86_64) * libcurl-minimal-8.22.0-0.1.hum1 (aarch64, x86_64) * curl-8.22.0-0.1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-13608

A flaw was found in libcurl's SASL (Simple Authentication and Security Layer) negotiation for LDAP (Lightweight Directory Access Protocol) authentication when using the OpenLDAP backend. An incomplete handshake sequence can be misinterpreted as a successful cryptographic verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack, could inject a premature response to bypass complete peer validation, leading to an authentication bypass.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Low

CVE-2026-18924

A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-416 - Use After Free

Affected products

Fixed 9 products, the same list as for CVE-2026-13608

Threats

Impact Low

CVE-2026-19931

A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection belonging to another user. This could lead to information disclosure or unauthorized access to sensitive data.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-488 - Exposure of Data Element to Wrong Session

Affected products

Fixed 9 products, the same list as for CVE-2026-13608

Threats

Impact Moderate

CVE-2026-80230

A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-303 - Incorrect Implementation of Authentication Algorithm

Affected products

Fixed 9 products, the same list as for CVE-2026-13608

Threats

Impact Low

CVE-2026-80231

A flaw was found in libcurl. This vulnerability allows libcurl to incorrectly reuse an existing HTTPS connection for a given hostname, even when a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) is specified for the new connection. This could potentially lead to a client trusting a malicious server if the initial connection used a less strict CA store than intended for subsequent connections.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 9 products, the same list as for CVE-2026-13608

Threats

Impact Low

CVE-2026-82209

A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a `Set-Cookie` header with a `Domain` attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope, leading to the cookie being inappropriately sent to arbitrary sibling subdomains under the same public suffix. This could result in sensitive information disclosure.

3.1 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-501 - Trust Boundary Violation

Affected products

Fixed 9 products, the same list as for CVE-2026-13608

Threats

Impact Low

References

54 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:63161	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-19931	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-13608	external
https://access.redhat.com/security/cve/CVE-2026-18924	external
https://access.redhat.com/security/cve/CVE-2026-82209	external
https://access.redhat.com/security/cve/CVE-2026-80231	external
https://access.redhat.com/security/cve/CVE-2026-80230	external
https://access.redhat.com/security/cve/CVE-2026-80229	external
https://access.redhat.com/security/cve/CVE-2026-80255	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-13608	self
https://bugzilla.redhat.com/show_bug.cgi?id=2529198	external
https://www.cve.org/CVERecord?id=CVE-2026-13608	external
https://nvd.nist.gov/vuln/detail/CVE-2026-13608	external
https://curl.se/docs/CVE-2026-13608.html	external
https://curl.se/docs/CVE-2026-13608.json	external
https://hackerone.com/reports/3822248	external
https://access.redhat.com/security/cve/CVE-2026-18924	self
https://bugzilla.redhat.com/show_bug.cgi?id=2529201	external
https://www.cve.org/CVERecord?id=CVE-2026-18924	external
https://nvd.nist.gov/vuln/detail/CVE-2026-18924	external
https://curl.se/docs/CVE-2026-18924.html	external
https://curl.se/docs/CVE-2026-18924.json	external
https://hackerone.com/reports/3916059	external
https://access.redhat.com/security/cve/CVE-2026-19931	self
https://bugzilla.redhat.com/show_bug.cgi?id=2529199	external
https://www.cve.org/CVERecord?id=CVE-2026-19931	external
https://nvd.nist.gov/vuln/detail/CVE-2026-19931	external
https://curl.se/docs/CVE-2026-19931.html	external
https://curl.se/docs/CVE-2026-19931.json	external
https://hackerone.com/reports/3923520	external
https://access.redhat.com/security/cve/CVE-2026-80230	self
https://bugzilla.redhat.com/show_bug.cgi?id=2529203	external
https://www.cve.org/CVERecord?id=CVE-2026-80230	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80230	external
https://curl.se/docs/CVE-2026-80230.html	external
https://curl.se/docs/CVE-2026-80230.json	external
https://hackerone.com/reports/3969300	external
https://access.redhat.com/security/cve/CVE-2026-80231	self
https://bugzilla.redhat.com/show_bug.cgi?id=2529204	external
https://www.cve.org/CVERecord?id=CVE-2026-80231	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80231	external
https://curl.se/docs/CVE-2026-80231.html	external
https://curl.se/docs/CVE-2026-80231.json	external
https://hackerone.com/reports/3969368	external
https://access.redhat.com/security/cve/CVE-2026-82209	self
https://bugzilla.redhat.com/show_bug.cgi?id=2529207	external
https://www.cve.org/CVERecord?id=CVE-2026-82209	external
https://nvd.nist.gov/vuln/detail/CVE-2026-82209	external
https://curl.se/docs/CVE-2026-82209.html	external
https://curl.se/docs/CVE-2026-82209.json	external
https://hackerone.com/reports/3972385	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ncurl:\n  * curl-8.22.0-0.1.hum1 (aarch64, x86_64)\n  * libcurl-8.22.0-0.1.hum1 (aarch64, x86_64)\n  * libcurl-devel-8.22.0-0.1.hum1 (aarch64, x86_64)\n  * libcurl-minimal-8.22.0-0.1.hum1 (aarch64, x86_64)\n  * curl-8.22.0-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:63161",
        "url": "https://access.redhat.com/errata/RHSA-2026:63161"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19931",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19931"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13608",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13608"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-18924",
        "url": "https://access.redhat.com/security/cve/CVE-2026-18924"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-82209",
        "url": "https://access.redhat.com/security/cve/CVE-2026-82209"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80231",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80231"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80230",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80230"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80229",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80229"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80255",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80255"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63161.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-22T10:15:23+00:00",
      "generator": {
        "date": "2026-09-22T10:15:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:63161",
      "initial_release_date": "2026-09-03T12:06:02+00:00",
      "revision_history": [
        {
          "date": "2026-09-03T12:06:02+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-07T15:40:34+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-22T10:15:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:8.22.0-0.1.hum1@aarch64",
                "product": {
                  "name": "curl-0:8.22.0-0.1.hum1@aarch64",
                  "product_id": "curl-0:8.22.0-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.22.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:8.22.0-0.1.hum1@aarch64",
                "product": {
                  "name": "libcurl-0:8.22.0-0.1.hum1@aarch64",
                  "product_id": "libcurl-0:8.22.0-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@8.22.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
                "product": {
                  "name": "libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
                  "product_id": "libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@8.22.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
                "product": {
                  "name": "libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
                  "product_id": "libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@8.22.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:8.22.0-0.1.hum1@src",
                "product": {
                  "name": "curl-0:8.22.0-0.1.hum1@src",
                  "product_id": "curl-0:8.22.0-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.22.0-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:8.22.0-0.1.hum1@x86_64",
                "product": {
                  "name": "curl-0:8.22.0-0.1.hum1@x86_64",
                  "product_id": "curl-0:8.22.0-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.22.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:8.22.0-0.1.hum1@x86_64",
                "product": {
                  "name": "libcurl-0:8.22.0-0.1.hum1@x86_64",
                  "product_id": "libcurl-0:8.22.0-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@8.22.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
                "product": {
                  "name": "libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
                  "product_id": "libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@8.22.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:8.22.0-0.1.hum1@x86_64",
                "product": {
                  "name": "libcurl-minimal-0:8.22.0-0.1.hum1@x86_64",
                  "product_id": "libcurl-minimal-0:8.22.0-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@8.22.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.22.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64"
        },
        "product_reference": "curl-0:8.22.0-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.22.0-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src"
        },
        "product_reference": "curl-0:8.22.0-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.22.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64"
        },
        "product_reference": "curl-0:8.22.0-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:8.22.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64"
        },
        "product_reference": "libcurl-0:8.22.0-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:8.22.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64"
        },
        "product_reference": "libcurl-0:8.22.0-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:8.22.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64"
        },
        "product_reference": "libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:8.22.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64"
        },
        "product_reference": "libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:8.22.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64"
        },
        "product_reference": "libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:8.22.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
        },
        "product_reference": "libcurl-minimal-0:8.22.0-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13608",
      "cwe": {
        "id": "CWE-923",
        "name": "Improper Restriction of Communication Channel to Intended Endpoints"
      },
      "discovery_date": "2026-09-06T17:50:55.239056+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529198"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl\u0027s SASL (Simple Authentication and Security Layer) negotiation for LDAP (Lightweight Directory Access Protocol) authentication when using the OpenLDAP backend. An incomplete handshake sequence can be misinterpreted as a successful cryptographic verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack, could inject a premature response to bypass complete peer validation, leading to an authentication bypass.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact flaw in libcurl\u0027s SASL negotiation for LDAP authentication could allow an attacker to bypass peer validation through a Man-in-the-Middle (MITM) attack. Exploitation requires an active network attacker to inject a premature response during the authentication handshake.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13608"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529198",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529198"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13608",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13608"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13608",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13608"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-13608.html",
          "url": "https://curl.se/docs/CVE-2026-13608.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-13608.json",
          "url": "https://curl.se/docs/CVE-2026-13608.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3822248",
          "url": "https://hackerone.com/reports/3822248"
        }
      ],
      "release_date": "2026-09-06T17:47:01.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T12:06:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63161"
        },
        {
          "category": "workaround",
          "details": "To mitigate enforce strict mutual authentication and cryptographic verification of both endpoints before transmitting sensitive data. Implement robust TLS/SSL configurations with explicit certificate pinning or strict CA validation to prevent Man-in-the-Middle (MITM) attackers from intercepting, prematurely concluding, or manipulating the handshake.",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack"
    },
    {
      "cve": "CVE-2026-18924",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-06T17:51:03.812362+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529201"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Low impact. It affects libcurl when configured to use HTTP/2 Server Push with shared connections, a non-default and less common deployment scenario in Red Hat products. Successful exploitation would lead to a use-after-free condition during resource cleanup, primarily impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18924"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529201",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529201"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18924",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18924"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18924",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18924"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-18924.html",
          "url": "https://curl.se/docs/CVE-2026-18924.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-18924.json",
          "url": "https://curl.se/docs/CVE-2026-18924.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3916059",
          "url": "https://hackerone.com/reports/3916059"
        }
      ],
      "release_date": "2026-09-06T17:47:27.820000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T12:06:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63161"
        },
        {
          "category": "workaround",
          "details": "Disable HTTP/2 Server Push (CURLMOPT_PUSHFUNCTION) and shared connection handles (CURL_LOCK_DATA_CONNECT) in libcurl clients to eliminate the vulnerable code path. If these features cannot be disabled, enforce host-based firewalls to restrict affected applications\u0027 outbound HTTPS traffic solely to trusted endpoints, neutralizing the risk of exploitation by malicious HTTP/2 servers.",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections"
    },
    {
      "cve": "CVE-2026-19931",
      "cwe": {
        "id": "CWE-488",
        "name": "Exposure of Data Element to Wrong Session"
      },
      "discovery_date": "2026-09-06T17:50:58.049067+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529199"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user\u0027s request can be sent over a previously authenticated connection belonging to another user. This could lead to information disclosure or unauthorized access to sensitive data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in libcurl allows for information disclosure when applications reuse HTTP connections with Negotiate authentication. If an initial request is made with empty credentials, a subsequent request from another user could be sent over the previously authenticated connection, potentially exposing sensitive data. This risk is specific to applications configured to use Negotiate authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19931"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529199",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529199"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19931",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19931"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19931",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19931"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-19931.html",
          "url": "https://curl.se/docs/CVE-2026-19931.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-19931.json",
          "url": "https://curl.se/docs/CVE-2026-19931.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3923520",
          "url": "https://hackerone.com/reports/3923520"
        }
      ],
      "release_date": "2026-09-06T17:47:43.523000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T12:06:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63161"
        },
        {
          "category": "workaround",
          "details": "To mitigate this prevent connection reuse (CURLOPT_FORBID_REUSE) for transfers using Negotiate authentication with empty credentials and strictly isolate libcurl connection pools across different security principals. For defense-in-depth, enforce network boundaries to limit outbound HTTP access, mitigating the impact of any potential cross-session data exposure while pending upstream patches.",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication"
    },
    {
      "cve": "CVE-2026-80230",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-09-06T18:01:13.480587+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529203"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connections that should have been rejected, potentially compromising the integrity of the connection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Public key pinning bypass allows unauthenticated connections",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact flaw in curl arises when public key pinning is enabled alongside explicitly disabled SSL/TLS peer verification. In such an atypical and insecure configuration, libcurl fails to enforce the public key pinning, allowing unauthenticated connections to proceed without proper certificate validation. Red Hat products typically employ secure default configurations that enable full peer verification, thus reducing exposure to this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80230"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529203",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529203"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80230",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80230"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80230",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80230"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-80230.html",
          "url": "https://curl.se/docs/CVE-2026-80230.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-80230.json",
          "url": "https://curl.se/docs/CVE-2026-80230.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3969300",
          "url": "https://hackerone.com/reports/3969300"
        }
      ],
      "release_date": "2026-09-06T17:48:16.262000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T12:06:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63161"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that SSL/TLS peer verification is enabled by setting `CURLOPT_SSL_VERIFYPEER` and `CURLOPT_SSL_VERIFYHOST` to `1` (or not explicitly disabling them). This ensures that libcurl properly enforces public key pinning and validates server certificates.",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "curl: curl: Public key pinning bypass allows unauthenticated connections"
    },
    {
      "cve": "CVE-2026-80231",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-09-06T18:01:16.842259+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl. This vulnerability allows libcurl to incorrectly reuse an existing HTTPS connection for a given hostname, even when a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) is specified for the new connection. This could potentially lead to a client trusting a malicious server if the initial connection used a less strict CA store than intended for subsequent connections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Incorrect HTTPS connection reuse with Native CA Store",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact flaw in libcurl arises from incorrect reuse of HTTPS connections when the `CURLSSLOPT_NATIVE_CA` option is employed with differing Native CA Store settings. This flaw does not affect any Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80231"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80231",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80231"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80231",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80231"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-80231.html",
          "url": "https://curl.se/docs/CVE-2026-80231.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-80231.json",
          "url": "https://curl.se/docs/CVE-2026-80231.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3969368",
          "url": "https://hackerone.com/reports/3969368"
        }
      ],
      "release_date": "2026-09-06T17:48:38.062000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T12:06:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63161"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "curl: curl: Incorrect HTTPS connection reuse with Native CA Store"
    },
    {
      "cve": "CVE-2026-82209",
      "cwe": {
        "id": "CWE-501",
        "name": "Trust Boundary Violation"
      },
      "discovery_date": "2026-09-06T18:01:25.138229+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a `Set-Cookie` header with a `Domain` attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope, leading to the cookie being inappropriately sent to arbitrary sibling subdomains under the same public suffix. This could result in sensitive information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: libcurl: Information disclosure via improper Public Suffix List boundary check",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Low because the resulting impact is limited to cookie leakage to sibling subdomains under a suffix, not data modification or system compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
          "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
          "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-82209"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-82209",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-82209"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82209",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82209"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-82209.html",
          "url": "https://curl.se/docs/CVE-2026-82209.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-82209.json",
          "url": "https://curl.se/docs/CVE-2026-82209.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3972385",
          "url": "https://hackerone.com/reports/3972385"
        }
      ],
      "release_date": "2026-09-06T17:49:35.050000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T12:06:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63161"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@src",
            "Red Hat Hardened Images:curl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-devel-0:8.22.0-0.1.hum1@x86_64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@aarch64",
            "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "curl: libcurl: Information disclosure via improper Public Suffix List boundary check"
    }
  ]
}

CVE-2026-13608 (GCVE-0-2026-13608)

Vulnerability from cvelistv5 – Published: 2026-09-06 17:47 – Updated: 2026-09-15 06:02

Title

OpenLDAP SASL authentication bypass

Summary

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 15:39 UTC

CWE

CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints

Assigner

curl redhat root

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-13608.json
https://curl.se/docs/CVE-2026-13608.html
https://hackerone.com/reports/3822248

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.82.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.1 (semver) Affected: 8.21.0 , < 8.22.0 (semver)
curl	curl	Affected: eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4 , < ea71c3b6b60e563651ea8596a975aef0c8199519 (git)
curl	curl	Affected: 8.21.0 Affected: 8.20.0 Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0

Credits

Eunsoo Kim (Autonomous Code Security team at Microsoft) Eunsoo Kim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-13608",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T15:39:09.395825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-923",
                "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T15:39:45.194Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3822248"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.82.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.1",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.22.0",
              "status": "affected",
              "version": "8.21.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "ea71c3b6b60e563651ea8596a975aef0c8199519",
              "status": "affected",
              "version": "eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.21.0"
            },
            {
              "status": "affected",
              "version": "8.20.0"
            },
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eunsoo Kim (Autonomous Code Security team at Microsoft)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Eunsoo Kim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-923",
              "description": "Improper Restriction of Communication Channel to Intended Endpoints",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:45.788Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-13608.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-13608.html"
        },
        {
          "url": "https://hackerone.com/reports/3822248"
        }
      ],
      "title": "OpenLDAP SASL authentication bypass",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.82.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.1"
                  },
                  {
                    "introduced": "8.21.0"
                  },
                  {
                    "fixed": "8.22.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4"
                  },
                  {
                    "fixed": "ea71c3b6b60e563651ea8596a975aef0c8199519"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.21.0",
              "8.20.0",
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-13608"
        ],
        "credits": [
          {
            "name": "Eunsoo Kim (Autonomous Code Security team at Microsoft)",
            "type": "finder"
          },
          {
            "name": "Eunsoo Kim",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Improper Restriction of Communication Channel to Intended Endpoints",
            "id": "CWE-923"
          },
          "URL": "https://curl.se/docs/CVE-2026-13608.json",
          "affects": "both",
          "issue": "https://hackerone.com/reports/3822248",
          "last_affected": "8.21.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2026-13608.html"
        },
        "details": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation.",
        "id": "CURL-CVE-2026-13608",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-09-02T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "OpenLDAP SASL authentication bypass"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-13608",
    "datePublished": "2026-09-06T17:47:01.951Z",
    "dateReserved": "2026-06-29T08:57:44.945Z",
    "dateUpdated": "2026-09-15T06:02:45.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18924 (GCVE-0-2026-18924)

Vulnerability from cvelistv5 – Published: 2026-09-06 17:47 – Updated: 2026-09-15 06:02

Title

HTTP/2 server push UAF

Summary

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 15:40 UTC

CWE

CWE-416 - Use After Free

Assigner

curl redhat root

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-18924.json
https://curl.se/docs/CVE-2026-18924.html
https://hackerone.com/reports/3916059

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.44.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.1 (semver) Affected: 8.21.0 , < 8.22.0 (semver)
curl	curl	Affected: ea7134ac874a66107e54ff93657ac565cf2ec4aa , < 90325ff0444cbdff368bda5d26d6405a0bb6ee43 (git)
curl	curl	Affected: 8.21.0 Affected: 8.20.0 Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0

Credits

Stephan Zeisberg (Security Research Labs) Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-18924",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T15:40:47.638991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T15:41:24.050Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3916059"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.44.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.1",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.22.0",
              "status": "affected",
              "version": "8.21.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "90325ff0444cbdff368bda5d26d6405a0bb6ee43",
              "status": "affected",
              "version": "ea7134ac874a66107e54ff93657ac565cf2ec4aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.21.0"
            },
            {
              "status": "affected",
              "version": "8.20.0"
            },
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            },
            {
              "status": "affected",
              "version": "7.44.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stephan Zeisberg (Security Research Labs)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in libcurl\u0027s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:47.329Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-18924.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-18924.html"
        },
        {
          "url": "https://hackerone.com/reports/3916059"
        }
      ],
      "title": "HTTP/2 server push UAF",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.44.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.1"
                  },
                  {
                    "introduced": "8.21.0"
                  },
                  {
                    "fixed": "8.22.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "ea7134ac874a66107e54ff93657ac565cf2ec4aa"
                  },
                  {
                    "fixed": "90325ff0444cbdff368bda5d26d6405a0bb6ee43"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.21.0",
              "8.20.0",
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0",
              "7.45.0",
              "7.44.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-18924"
        ],
        "credits": [
          {
            "name": "Stephan Zeisberg (Security Research Labs)",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Use After Free",
            "id": "CWE-416"
          },
          "URL": "https://curl.se/docs/CVE-2026-18924.json",
          "affects": "lib",
          "issue": "https://hackerone.com/reports/3916059",
          "last_affected": "8.21.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2026-18924.html"
        },
        "details": "A flaw in libcurl\u0027s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.",
        "id": "CURL-CVE-2026-18924",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-09-02T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "HTTP/2 server push UAF"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-18924",
    "datePublished": "2026-09-06T17:47:27.820Z",
    "dateReserved": "2026-08-05T08:31:56.125Z",
    "dateUpdated": "2026-09-15T06:02:47.329Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19931 (GCVE-0-2026-19931)

Vulnerability from cvelistv5 – Published: 2026-09-06 17:47 – Updated: 2026-09-15 06:02

Title

Negotiate ambient user conn reuse

Summary

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 15:42 UTC

CWE

CWE-488 - Exposure of Data Element to Wrong Session

Assigner

curl redhat root

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-19931.json
https://curl.se/docs/CVE-2026-19931.html
https://hackerone.com/reports/3923520

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.64.1 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.1 (semver) Affected: 8.21.0 , < 8.22.0 (semver)
curl	curl	Affected: 6c6035532383e300c712e4c1cd9fdd749ed5cf59 , < 7103a93b05bc69ea98ed9d05d02fa9eeba533f2f (git)
curl	curl	Affected: 8.21.0 Affected: 8.20.0 Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1

Credits

Martin Dukek Stefan Eissing

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-19931",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T15:42:15.881334Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-488",
                "description": "CWE-488 Exposure of Data Element to Wrong Session",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T15:42:43.125Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3923520"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.64.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.1",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.22.0",
              "status": "affected",
              "version": "8.21.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "7103a93b05bc69ea98ed9d05d02fa9eeba533f2f",
              "status": "affected",
              "version": "6c6035532383e300c712e4c1cd9fdd749ed5cf59",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.21.0"
            },
            {
              "status": "affected",
              "version": "8.20.0"
            },
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Martin Dukek"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stefan Eissing"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0027s request get sent over user A\u0027s\npreviously authenticated connection."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-488",
              "description": "Exposure of Data Element to Wrong Session",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:51.009Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-19931.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-19931.html"
        },
        {
          "url": "https://hackerone.com/reports/3923520"
        }
      ],
      "title": "Negotiate ambient user conn reuse",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.64.1"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.1"
                  },
                  {
                    "introduced": "8.21.0"
                  },
                  {
                    "fixed": "8.22.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "6c6035532383e300c712e4c1cd9fdd749ed5cf59"
                  },
                  {
                    "fixed": "7103a93b05bc69ea98ed9d05d02fa9eeba533f2f"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.21.0",
              "8.20.0",
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-19931"
        ],
        "credits": [
          {
            "name": "Martin Dukek",
            "type": "finder"
          },
          {
            "name": "Stefan Eissing",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Exposure of Data Element to Wrong Session",
            "id": "CWE-488"
          },
          "URL": "https://curl.se/docs/CVE-2026-19931.json",
          "affects": "both",
          "issue": "https://hackerone.com/reports/3923520",
          "last_affected": "8.21.0",
          "package": "curl",
          "severity": "Medium",
          "www": "https://curl.se/docs/CVE-2026-19931.html"
        },
        "details": "A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0027s request get sent over user A\u0027s\npreviously authenticated connection.",
        "id": "CURL-CVE-2026-19931",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-09-02T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "Negotiate ambient user conn reuse"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-19931",
    "datePublished": "2026-09-06T17:47:43.523Z",
    "dateReserved": "2026-08-15T10:35:02.789Z",
    "dateUpdated": "2026-09-15T06:02:51.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80230 (GCVE-0-2026-80230)

Vulnerability from cvelistv5 – Published: 2026-09-06 17:48 – Updated: 2026-09-15 06:03

Title

OpenSSL pinning bypass

Summary

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:51 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

curl redhat root

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-80230.json
https://curl.se/docs/CVE-2026-80230.html
https://hackerone.com/reports/3969300

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.45.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.1 (semver) Affected: 8.21.0 , < 8.22.0 (semver)
curl	curl	Affected: 8363656cb4e0c60a11d8531ead0ec43120b50591 , < 5267ed859d545534d0c21675a2b70af5a3b6e3ef (git)
curl	curl	Affected: 8.21.0 Affected: 8.20.0 Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0

Credits

Stanislav Fort (Aisle Research) Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-80230",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:51:52.168741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-295",
                "description": "CWE-295 Improper Certificate Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:53:26.975Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3969300"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.45.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.1",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.22.0",
              "status": "affected",
              "version": "8.21.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "5267ed859d545534d0c21675a2b70af5a3b6e3ef",
              "status": "affected",
              "version": "8363656cb4e0c60a11d8531ead0ec43120b50591",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.21.0"
            },
            {
              "status": "affected",
              "version": "8.20.0"
            },
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stanislav Fort (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:03:10.429Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-80230.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-80230.html"
        },
        {
          "url": "https://hackerone.com/reports/3969300"
        }
      ],
      "title": "OpenSSL pinning bypass",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.45.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.1"
                  },
                  {
                    "introduced": "8.21.0"
                  },
                  {
                    "fixed": "8.22.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "8363656cb4e0c60a11d8531ead0ec43120b50591"
                  },
                  {
                    "fixed": "5267ed859d545534d0c21675a2b70af5a3b6e3ef"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.21.0",
              "8.20.0",
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0",
              "7.45.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-80230"
        ],
        "credits": [
          {
            "name": "Stanislav Fort (Aisle Research)",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Improper Certificate Validation",
            "id": "CWE-295"
          },
          "URL": "https://curl.se/docs/CVE-2026-80230.json",
          "affects": "both",
          "issue": "https://hackerone.com/reports/3969300",
          "last_affected": "8.21.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2026-80230.html"
        },
        "details": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.",
        "id": "CURL-CVE-2026-80230",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-09-02T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "OpenSSL pinning bypass"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-80230",
    "datePublished": "2026-09-06T17:48:16.262Z",
    "dateReserved": "2026-08-26T04:24:25.568Z",
    "dateUpdated": "2026-09-15T06:03:10.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80231 (GCVE-0-2026-80231)

Vulnerability from cvelistv5 – Published: 2026-09-06 17:48 – Updated: 2026-09-15 06:03

Title

native CA store conn reuse

Summary

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:50 UTC

CWE

CWE-488 - Exposure of Data Element to Wrong Session

Assigner

curl redhat root

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-80231.json
https://curl.se/docs/CVE-2026-80231.html
https://hackerone.com/reports/3969368

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.71.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.1 (semver) Affected: 8.21.0 , < 8.22.0 (semver)
curl	curl	Affected: 148534db57dda611cf8516e92e4d6e35fc1e5074 , < 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42 (git)
curl	curl	Affected: 8.21.0 Affected: 8.20.0 Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0

Credits

Stanislav Fort (Aisle Research) Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-80231",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:50:09.901920Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-488",
                "description": "CWE-488 Exposure of Data Element to Wrong Session",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:51:07.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3969368"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.71.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.1",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.22.0",
              "status": "affected",
              "version": "8.21.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42",
              "status": "affected",
              "version": "148534db57dda611cf8516e92e4d6e35fc1e5074",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.21.0"
            },
            {
              "status": "affected",
              "version": "8.20.0"
            },
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stanislav Fort (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-488",
              "description": "Exposure of Data Element to Wrong Session",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:03:11.962Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-80231.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-80231.html"
        },
        {
          "url": "https://hackerone.com/reports/3969368"
        }
      ],
      "title": "native CA store conn reuse",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.71.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.1"
                  },
                  {
                    "introduced": "8.21.0"
                  },
                  {
                    "fixed": "8.22.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "148534db57dda611cf8516e92e4d6e35fc1e5074"
                  },
                  {
                    "fixed": "7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.21.0",
              "8.20.0",
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-80231"
        ],
        "credits": [
          {
            "name": "Stanislav Fort (Aisle Research)",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Exposure of Data Element to Wrong Session",
            "id": "CWE-488"
          },
          "URL": "https://curl.se/docs/CVE-2026-80231.json",
          "affects": "both",
          "issue": "https://hackerone.com/reports/3969368",
          "last_affected": "8.21.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2026-80231.html"
        },
        "details": "A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.",
        "id": "CURL-CVE-2026-80231",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-09-02T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "native CA store conn reuse"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-80231",
    "datePublished": "2026-09-06T17:48:38.062Z",
    "dateReserved": "2026-08-26T04:24:27.361Z",
    "dateUpdated": "2026-09-15T06:03:11.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82209 (GCVE-0-2026-82209)

Vulnerability from cvelistv5 – Published: 2026-09-06 17:49 – Updated: 2026-09-15 06:03

Title

domain-scoped PSL domain cookie

Summary

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:47 UTC

CWE

CWE-201 - Information Exposure Through Sent Data
CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

curl redhat root

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-82209.json
https://curl.se/docs/CVE-2026-82209.html
https://hackerone.com/reports/3972385

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.46.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.1 (semver) Affected: 8.21.0 , < 8.22.0 (semver)
curl	curl	Affected: e77b5b7453c1e8ccd7ec0816890d98e2f392e465 , < 95c1e8915dce64606bd753fd47fc0bd236e31cd6 (git)
curl	curl	Affected: 8.21.0 Affected: 8.20.0 Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0

Credits

Stanislav Fort (Aisle Research) Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-82209",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:47:09.259604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-201",
                "description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:48:32.841Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3972385"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.46.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.1",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.22.0",
              "status": "affected",
              "version": "8.21.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "95c1e8915dce64606bd753fd47fc0bd236e31cd6",
              "status": "affected",
              "version": "e77b5b7453c1e8ccd7ec0816890d98e2f392e465",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.21.0"
            },
            {
              "status": "affected",
              "version": "8.20.0"
            },
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stanislav Fort (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "Information Exposure Through Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:03:16.294Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-82209.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-82209.html"
        },
        {
          "url": "https://hackerone.com/reports/3972385"
        }
      ],
      "title": "domain-scoped PSL domain cookie",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.46.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.1"
                  },
                  {
                    "introduced": "8.21.0"
                  },
                  {
                    "fixed": "8.22.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "e77b5b7453c1e8ccd7ec0816890d98e2f392e465"
                  },
                  {
                    "fixed": "95c1e8915dce64606bd753fd47fc0bd236e31cd6"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.21.0",
              "8.20.0",
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-82209"
        ],
        "credits": [
          {
            "name": "Stanislav Fort (Aisle Research)",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Information Exposure Through Sent Data",
            "id": "CWE-201"
          },
          "URL": "https://curl.se/docs/CVE-2026-82209.json",
          "affects": "both",
          "issue": "https://hackerone.com/reports/3972385",
          "last_affected": "8.21.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2026-82209.html"
        },
        "details": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).",
        "id": "CURL-CVE-2026-82209",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-09-02T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "domain-scoped PSL domain cookie"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-82209",
    "datePublished": "2026-09-06T17:49:35.050Z",
    "dateReserved": "2026-08-28T08:25:48.340Z",
    "dateUpdated": "2026-09-15T06:03:16.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:63161

CVE-2026-13608 (GCVE-0-2026-13608)

CVE-2026-18924 (GCVE-0-2026-18924)

CVE-2026-19931 (GCVE-0-2026-19931)

CVE-2026-80230 (GCVE-0-2026-80230)

CVE-2026-80231 (GCVE-0-2026-80231)

CVE-2026-82209 (GCVE-0-2026-82209)

Tags

Sightings

Nomenclature

Related by attack behaviour