diff --git a/tools/apitester/__snapshots__/cassette_TestCommand.snap b/tools/apitester/__snapshots__/cassette_TestCommand.snap index 555435e0a11..691629637ca 100755 --- a/tools/apitester/__snapshots__/cassette_TestCommand.snap +++ b/tools/apitester/__snapshots__/cassette_TestCommand.snap @@ -8617,6 +8617,10 @@ { "id": "PYSEC-2026-2320", "modified": "" + }, + { + "id": "PYSEC-2026-4312", + "modified": "" } ] }, @@ -8656,6 +8660,10 @@ { "id": "PYSEC-2026-2320", "modified": "" + }, + { + "id": "PYSEC-2026-4312", + "modified": "" } ] }, @@ -8695,6 +8703,10 @@ { "id": "PYSEC-2026-2320", "modified": "" + }, + { + "id": "PYSEC-2026-4312", + "modified": "" } ] } @@ -9921,6 +9933,10 @@ { "id": "PYSEC-2026-2320", "modified": "" + }, + { + "id": "PYSEC-2026-4312", + "modified": "" } ] }, @@ -9960,6 +9976,10 @@ { "id": "PYSEC-2026-2320", "modified": "" + }, + { + "id": "PYSEC-2026-4312", + "modified": "" } ] }, @@ -9999,6 +10019,10 @@ { "id": "PYSEC-2026-2320", "modified": "" + }, + { + "id": "PYSEC-2026-4312", + "modified": "" } ] } diff --git a/tools/apitester/__snapshots__/cassette_TestCommand_Transitive.snap b/tools/apitester/__snapshots__/cassette_TestCommand_Transitive.snap index 4b4311097a7..34b78c5eb39 100755 --- a/tools/apitester/__snapshots__/cassette_TestCommand_Transitive.snap +++ b/tools/apitester/__snapshots__/cassette_TestCommand_Transitive.snap @@ -2301,6 +2301,10 @@ { "id": "PYSEC-2026-2320", "modified": "" + }, + { + "id": "PYSEC-2026-4312", + "modified": "" } ] } diff --git a/tools/apitester/__snapshots__/cassette_single_query.snap b/tools/apitester/__snapshots__/cassette_single_query.snap index 8cb51124b0c..96092c1211a 100755 --- a/tools/apitester/__snapshots__/cassette_single_query.snap +++ b/tools/apitester/__snapshots__/cassette_single_query.snap @@ -1240,6 +1240,61 @@ } ] }, + { + "id": "CURL-CVE-2026-107928", + "summary": "info leak uploading over WebSockets with GnuTLS", + "details": "When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send.", + "aliases": ["CVE-2026-107928"], + "modified": "", + "published": "2026-10-14T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.86.0" + }, + { + "fixed": "8.23.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "664249d095275ec532f55dd1752d80c8c1093a77" + }, + { + "fixed": "64fb3e7a7b116f690966054f281624152d4a7651" + } + ] + } + ], + "versions": 93, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Luna with Claude", + "type": "FINDER" + }, + { + "name": "Anthropic", + "type": "FINDER" + }, + { + "name": "Stefan Eissing", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, { "id": "CURL-CVE-2026-11856", "summary": "cross-origin Digest auth state leak", @@ -2054,13 +2109,724 @@ "introduced": "8.15.0" }, { - "fixed": "8.16.1" + "fixed": "8.16.1" + }, + { + "introduced": "8.17.0" + }, + { + "fixed": "8.20.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "e15e51384a423be31318b3c9c7d612a1aae661fd" + }, + { + "fixed": "3a19987a87f393d9394fe5acc7643f6c263c92db" + } + ] + } + ], + "versions": 116, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Muhamad Arga Reksapati", + "type": "FINDER" + }, + { + "name": "Daniel Stenberg", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-6429", + "summary": "netrc credential leak with reused proxy connection", + "details": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.", + "aliases": ["CVE-2026-6429"], + "modified": "", + "published": "2026-04-29T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.14.0" + }, + { + "fixed": "8.14.2" + }, + { + "introduced": "8.15.0" + }, + { + "fixed": "8.16.1" + }, + { + "introduced": "8.17.0" + }, + { + "fixed": "8.20.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "01165e08e0d131b399fba2190f17af67e66f0888" + }, + { + "fixed": "b4024bf808bd558026fdc6096e8457f199ace306" + } + ] + } + ], + "versions": 328, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Muhamad Arga Reksapati", + "type": "FINDER" + }, + { + "name": "Daniel Stenberg", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-7168", + "summary": "cross-proxy Digest auth state leak", + "details": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.", + "aliases": ["CVE-2026-7168"], + "modified": "", + "published": "2026-04-29T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.12.0" + }, + { + "fixed": "8.14.2" + }, + { + "introduced": "8.15.0" + }, + { + "fixed": "8.16.1" + }, + { + "introduced": "8.17.0" + }, + { + "fixed": "8.20.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "fc6eff13b5414caf6edf22d73a3239e074a04216" + }, + { + "fixed": "c1cfdf59acbaf9504c4578d4cf56cdd7c8594507" + } + ] + } + ], + "versions": 344, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Muhamad Arga Reksapati", + "type": "FINDER" + }, + { + "name": "Daniel Stenberg", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-80230", + "summary": "OpenSSL pinning bypass", + "details": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.", + "aliases": ["CVE-2026-80230"], + "modified": "", + "published": "2026-09-02T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.45.0" + }, + { + "fixed": "8.14.2" + }, + { + "introduced": "8.15.0" + }, + { + "fixed": "8.16.1" + }, + { + "introduced": "8.17.0" + }, + { + "fixed": "8.20.1" + }, + { + "introduced": "8.21.0" + }, + { + "fixed": "8.22.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "8363656cb4e0c60a11d8531ead0ec43120b50591" + }, + { + "fixed": "5267ed859d545534d0c21675a2b70af5a3b6e3ef" + } + ] + } + ], + "versions": 210, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Stanislav Fort (Aisle Research)", + "type": "FINDER" + }, + { + "name": "Daniel Stenberg", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-80231", + "summary": "native CA store conn reuse", + "details": "A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.", + "aliases": ["CVE-2026-80231"], + "modified": "", + "published": "2026-09-02T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.71.0" + }, + { + "fixed": "8.14.2" + }, + { + "introduced": "8.15.0" + }, + { + "fixed": "8.16.1" + }, + { + "introduced": "8.17.0" + }, + { + "fixed": "8.20.1" + }, + { + "introduced": "8.21.0" + }, + { + "fixed": "8.22.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "148534db57dda611cf8516e92e4d6e35fc1e5074" + }, + { + "fixed": "7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42" + } + ] + } + ], + "versions": 126, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Stanislav Fort (Aisle Research)", + "type": "FINDER" + }, + { + "name": "Daniel Stenberg", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-82209", + "summary": "domain-scoped PSL domain cookie", + "details": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).", + "aliases": ["CVE-2026-82209"], + "modified": "", + "published": "2026-09-02T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.46.0" + }, + { + "fixed": "8.14.2" + }, + { + "introduced": "8.15.0" + }, + { + "fixed": "8.16.1" + }, + { + "introduced": "8.17.0" + }, + { + "fixed": "8.20.1" + }, + { + "introduced": "8.21.0" + }, + { + "fixed": "8.22.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "e77b5b7453c1e8ccd7ec0816890d98e2f392e465" + }, + { + "fixed": "95c1e8915dce64606bd753fd47fc0bd236e31cd6" + } + ] + } + ], + "versions": 209, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Stanislav Fort (Aisle Research)", + "type": "FINDER" + }, + { + "name": "Daniel Stenberg", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-8286", + "summary": "wrong STARTTLS connection reuse", + "details": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", + "aliases": ["CVE-2026-8286"], + "modified": "", + "published": "2026-06-24T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.30.0" + }, + { + "fixed": "8.14.2" + }, + { + "introduced": "8.15.0" + }, + { + "fixed": "8.16.1" + }, + { + "introduced": "8.17.0" + }, + { + "fixed": "8.20.1" + }, + { + "introduced": "8.21.0" + }, + { + "fixed": "8.21.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "a1701eea289fe7ea80651f801cf992838a491dde" + }, + { + "fixed": "a86efdd7ca5433de9231e650f18247de8319ad16" + } + ] + } + ], + "versions": 237, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Andrew Nesbitt (powered by Mythos)", + "type": "FINDER" + }, + { + "name": "Stefan Eissing", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-8458", + "summary": "wrong reuse for different services", + "details": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", + "aliases": ["CVE-2026-8458"], + "modified": "", + "published": "2026-06-24T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.43.0" + }, + { + "fixed": "8.14.2" + }, + { + "introduced": "8.15.0" + }, + { + "fixed": "8.16.1" + }, + { + "introduced": "8.17.0" + }, + { + "fixed": "8.20.1" + }, + { + "introduced": "8.21.0" + }, + { + "fixed": "8.21.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "97c272e5d173ad5f706443e2477f0a84f0044edd" + }, + { + "fixed": "5e99b73cf441d9c369768b9cd48b5389b9a2503d" + } + ] + } + ], + "versions": 207, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Muhamad Arga Reksapati", + "type": "FINDER" + }, + { + "name": "Stefan Eissing", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-86409", + "summary": "stale SigV4 headers sent unintended", + "details": "Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nis set next, leaking state information.", + "aliases": ["CVE-2026-86409"], + "modified": "", + "published": "2026-10-14T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.75.0" + }, + { + "fixed": "8.22.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "08e8455dddc5e48e58a12ade3815c01ae3da3b64" + }, + { + "fixed": "c3c70440e8d9938c0bb732595751e8aebc614f24" + } + ] + } + ], + "versions": 116, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Stanislav Fort (Aisle Research)", + "type": "FINDER" + }, + { + "name": "Viktor Szakats", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-86414", + "summary": "leaking host credentials to HTTP proxy", + "details": "An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`.", + "aliases": ["CVE-2026-86414"], + "modified": "", + "published": "2026-10-14T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.10.8" + }, + { + "fixed": "8.23.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "52ceab5e41a01b4d1227876d51a3680a3ce5a841" + }, + { + "fixed": "2956af6c7451029fb12c12f8166dff211f930d52" + } + ] + } + ], + "versions": 364, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Stanislav Fort (Aisle Research)", + "type": "FINDER" + }, + { + "name": "Stefan Eissing", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-87863", + "summary": "HSTS response erases persisted entries", + "details": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss.", + "aliases": ["CVE-2026-87863"], + "modified": "", + "published": "2026-10-14T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "8.2.0" + }, + { + "fixed": "8.14.3" + }, + { + "introduced": "8.15.0" + }, + { + "fixed": "8.16.2" + }, + { + "introduced": "8.17.0" + }, + { + "fixed": "8.20.2" + }, + { + "introduced": "8.21.0" + }, + { + "fixed": "8.23.0" + } + ] + }, + { + "type": "GIT", + "repo": "https://github.com/curl/curl.git", + "events": [ + { + "introduced": "0c667188e0c6cda615a036b8a2b4125f2c404dde" + }, + { + "fixed": "08d50a791b3197a3d0a4fc2f778e243f5501c67e" + } + ] + } + ], + "versions": 72, + "database_specific": "" + } + ], + "schema_version": "1.9.0", + "credits": [ + { + "name": "Stanislav Fort (Aisle Research)", + "type": "FINDER" + }, + { + "name": "Daniel Stenberg", + "type": "REMEDIATION_DEVELOPER" + } + ] + }, + { + "id": "CURL-CVE-2026-87864", + "summary": "IMAP APPEND plus CRLF conversion command injection", + "details": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session.", + "aliases": ["CVE-2026-87864"], + "modified": "", + "published": "2026-10-14T08:00:00Z", + "database_specific": "", + "affected": [ + { + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.30.0" + }, + { + "fixed": "8.14.3" + }, + { + "introduced": "8.15.0" + }, + { + "fixed": "8.16.2" }, { "introduced": "8.17.0" }, { - "fixed": "8.20.0" + "fixed": "8.20.2" + }, + { + "introduced": "8.21.0" + }, + { + "fixed": "8.22.0" } ] }, @@ -2069,37 +2835,37 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "e15e51384a423be31318b3c9c7d612a1aae661fd" + "introduced": "f8c8c76d39ac2fa825481ba42ab2247cd122f963" }, { - "fixed": "3a19987a87f393d9394fe5acc7643f6c263c92db" + "fixed": "3b547de301342b347fb3c6ea6ae7979070793a66" } ] } ], - "versions": 116, + "versions": 245, "database_specific": "" } ], "schema_version": "1.9.0", "credits": [ { - "name": "Muhamad Arga Reksapati", + "name": "Stanislav Fort (Aisle Research)", "type": "FINDER" }, { - "name": "Daniel Stenberg", + "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ] }, { - "id": "CURL-CVE-2026-6429", - "summary": "netrc credential leak with reused proxy connection", - "details": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.", - "aliases": ["CVE-2026-6429"], + "id": "CURL-CVE-2026-87865", + "summary": "knownhost callback mismatches key as missing", + "details": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.", + "aliases": ["CVE-2026-87865"], "modified": "", - "published": "2026-04-29T08:00:00Z", + "published": "2026-10-14T08:00:00Z", "database_specific": "", "affected": [ { @@ -2108,22 +2874,28 @@ "type": "SEMVER", "events": [ { - "introduced": "7.14.0" + "introduced": "7.69.1" }, { - "fixed": "8.14.2" + "fixed": "8.14.3" }, { "introduced": "8.15.0" }, { - "fixed": "8.16.1" + "fixed": "8.16.2" }, { "introduced": "8.17.0" }, { - "fixed": "8.20.0" + "fixed": "8.20.2" + }, + { + "introduced": "8.21.0" + }, + { + "fixed": "8.23.0" } ] }, @@ -2132,37 +2904,37 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "01165e08e0d131b399fba2190f17af67e66f0888" + "introduced": "e96fe70cabcb3a5a009821dbb453dc0160ddc3f5" }, { - "fixed": "b4024bf808bd558026fdc6096e8457f199ace306" + "fixed": "323c184b6bdf5b1988a10c0a61560666e1588149" } ] } ], - "versions": 328, + "versions": 133, "database_specific": "" } ], "schema_version": "1.9.0", "credits": [ { - "name": "Muhamad Arga Reksapati", + "name": "Bobbeh Rhino", "type": "FINDER" }, { - "name": "Daniel Stenberg", + "name": "Bobbeh Rhino", "type": "REMEDIATION_DEVELOPER" } ] }, { - "id": "CURL-CVE-2026-7168", - "summary": "cross-proxy Digest auth state leak", - "details": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.", - "aliases": ["CVE-2026-7168"], + "id": "CURL-CVE-2026-87866", + "summary": "wolfSSL public-key pinning bypass", + "details": "When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.", + "aliases": ["CVE-2026-87866"], "modified": "", - "published": "2026-04-29T08:00:00Z", + "published": "2026-10-14T08:00:00Z", "database_specific": "", "affected": [ { @@ -2171,22 +2943,28 @@ "type": "SEMVER", "events": [ { - "introduced": "7.12.0" + "introduced": "7.43.0" }, { - "fixed": "8.14.2" + "fixed": "8.14.3" }, { "introduced": "8.15.0" }, { - "fixed": "8.16.1" + "fixed": "8.16.2" }, { "introduced": "8.17.0" }, { - "fixed": "8.20.0" + "fixed": "8.20.2" + }, + { + "introduced": "8.21.0" + }, + { + "fixed": "8.23.0" } ] }, @@ -2195,15 +2973,15 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "fc6eff13b5414caf6edf22d73a3239e074a04216" + "introduced": "0675abbc7572ff6d711a1f325d9b812f98bce78f" }, { - "fixed": "c1cfdf59acbaf9504c4578d4cf56cdd7c8594507" + "fixed": "ed131747c1a3dc7f816d26724c44537ac8acba44" } ] } ], - "versions": 344, + "versions": 217, "database_specific": "" } ], @@ -2214,18 +2992,18 @@ "type": "FINDER" }, { - "name": "Daniel Stenberg", + "name": "Stefan Eissing", "type": "REMEDIATION_DEVELOPER" } ] }, { - "id": "CURL-CVE-2026-80230", - "summary": "OpenSSL pinning bypass", - "details": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.", - "aliases": ["CVE-2026-80230"], + "id": "CURL-CVE-2026-8924", + "summary": "trailing dot domain super cookie", + "details": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.", + "aliases": ["CVE-2026-8924"], "modified": "", - "published": "2026-09-02T08:00:00Z", + "published": "2026-06-24T08:00:00Z", "database_specific": "", "affected": [ { @@ -2234,7 +3012,7 @@ "type": "SEMVER", "events": [ { - "introduced": "7.45.0" + "introduced": "7.46.0" }, { "fixed": "8.14.2" @@ -2255,7 +3033,7 @@ "introduced": "8.21.0" }, { - "fixed": "8.22.0" + "fixed": "8.21.0" } ] }, @@ -2264,22 +3042,22 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "8363656cb4e0c60a11d8531ead0ec43120b50591" + "introduced": "e77b5b7453c1e8ccd7ec0816890d98e2f392e465" }, { - "fixed": "5267ed859d545534d0c21675a2b70af5a3b6e3ef" + "fixed": "51beed175dbfc37da3113f6acce60c630c070ce8" } ] } ], - "versions": 210, + "versions": 201, "database_specific": "" } ], "schema_version": "1.9.0", "credits": [ { - "name": "Stanislav Fort (Aisle Research)", + "name": "vegagent on hackerone", "type": "FINDER" }, { @@ -2289,12 +3067,12 @@ ] }, { - "id": "CURL-CVE-2026-80231", - "summary": "native CA store conn reuse", - "details": "A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.", - "aliases": ["CVE-2026-80231"], + "id": "CURL-CVE-2026-8927", + "summary": "env-set cross-proxy Digest auth state leak", + "details": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", + "aliases": ["CVE-2026-8927"], "modified": "", - "published": "2026-09-02T08:00:00Z", + "published": "2026-06-24T08:00:00Z", "database_specific": "", "affected": [ { @@ -2303,7 +3081,7 @@ "type": "SEMVER", "events": [ { - "introduced": "7.71.0" + "introduced": "7.12.0" }, { "fixed": "8.14.2" @@ -2324,7 +3102,7 @@ "introduced": "8.21.0" }, { - "fixed": "8.22.0" + "fixed": "8.21.0" } ] }, @@ -2333,22 +3111,22 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "148534db57dda611cf8516e92e4d6e35fc1e5074" + "introduced": "fc6eff13b5414caf6edf22d73a3239e074a04216" }, { - "fixed": "7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42" + "fixed": "5c225384b8d52c67ce8259c6e4203bc57aacb567" } ] } ], - "versions": 126, + "versions": 346, "database_specific": "" } ], "schema_version": "1.9.0", "credits": [ { - "name": "Stanislav Fort (Aisle Research)", + "name": "Ady Elouej", "type": "FINDER" }, { @@ -2358,12 +3136,12 @@ ] }, { - "id": "CURL-CVE-2026-82209", - "summary": "domain-scoped PSL domain cookie", - "details": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).", - "aliases": ["CVE-2026-82209"], + "id": "CURL-CVE-2026-8932", + "summary": "incomplete mTLS config matching in conn reuse", + "details": "libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key.", + "aliases": ["CVE-2026-8932"], "modified": "", - "published": "2026-09-02T08:00:00Z", + "published": "2026-06-24T08:00:00Z", "database_specific": "", "affected": [ { @@ -2372,7 +3150,7 @@ "type": "SEMVER", "events": [ { - "introduced": "7.46.0" + "introduced": "7.7" }, { "fixed": "8.14.2" @@ -2393,7 +3171,7 @@ "introduced": "8.21.0" }, { - "fixed": "8.22.0" + "fixed": "8.21.0" } ] }, @@ -2402,37 +3180,37 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "e77b5b7453c1e8ccd7ec0816890d98e2f392e465" + "introduced": "a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4" }, { - "fixed": "95c1e8915dce64606bd753fd47fc0bd236e31cd6" + "fixed": "7541ae569d82fb308a5e2d94916027da4fa3ba3e" } ] } ], - "versions": 209, + "versions": 414, "database_specific": "" } ], "schema_version": "1.9.0", "credits": [ { - "name": "Stanislav Fort (Aisle Research)", + "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { - "name": "Daniel Stenberg", + "name": "Joshua Rogers (Aisle Research)", "type": "REMEDIATION_DEVELOPER" } ] }, { - "id": "CURL-CVE-2026-8286", - "summary": "wrong STARTTLS connection reuse", - "details": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", - "aliases": ["CVE-2026-8286"], + "id": "CURL-CVE-2026-92388", + "summary": "FTP wildcard write callback mixup", + "details": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer.", + "aliases": ["CVE-2026-92388"], "modified": "", - "published": "2026-06-24T08:00:00Z", + "published": "2026-10-14T08:00:00Z", "database_specific": "", "affected": [ { @@ -2441,28 +3219,10 @@ "type": "SEMVER", "events": [ { - "introduced": "7.30.0" - }, - { - "fixed": "8.14.2" - }, - { - "introduced": "8.15.0" - }, - { - "fixed": "8.16.1" - }, - { - "introduced": "8.17.0" - }, - { - "fixed": "8.20.1" + "introduced": "7.21.0" }, { - "introduced": "8.21.0" - }, - { - "fixed": "8.21.0" + "fixed": "8.23.0" } ] }, @@ -2471,37 +3231,37 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "a1701eea289fe7ea80651f801cf992838a491dde" + "introduced": "0825cd80a62c21725fb3615f1fdd3aa6cc5f0f34" }, { - "fixed": "a86efdd7ca5433de9231e650f18247de8319ad16" + "fixed": "ba8f8a7f27a5c5e19e4ef212b90b35a93559163e" } ] } ], - "versions": 237, + "versions": 283, "database_specific": "" } ], "schema_version": "1.9.0", "credits": [ { - "name": "Andrew Nesbitt (powered by Mythos)", + "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { - "name": "Stefan Eissing", + "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ] }, { - "id": "CURL-CVE-2026-8458", - "summary": "wrong reuse for different services", - "details": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", - "aliases": ["CVE-2026-8458"], + "id": "CURL-CVE-2026-92389", + "summary": "TFTP direction confusion", + "details": "libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle.", + "aliases": ["CVE-2026-92389"], "modified": "", - "published": "2026-06-24T08:00:00Z", + "published": "2026-10-14T08:00:00Z", "database_specific": "", "affected": [ { @@ -2510,28 +3270,28 @@ "type": "SEMVER", "events": [ { - "introduced": "7.43.0" + "introduced": "7.15.0" }, { - "fixed": "8.14.2" + "fixed": "8.14.3" }, { "introduced": "8.15.0" }, { - "fixed": "8.16.1" + "fixed": "8.16.2" }, { "introduced": "8.17.0" }, { - "fixed": "8.20.1" + "fixed": "8.20.2" }, { "introduced": "8.21.0" }, { - "fixed": "8.21.0" + "fixed": "8.23.0" } ] }, @@ -2540,37 +3300,37 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "97c272e5d173ad5f706443e2477f0a84f0044edd" + "introduced": "56d9624b566ac15ffb4b4b6eef220a5000b767e0" }, { - "fixed": "5e99b73cf441d9c369768b9cd48b5389b9a2503d" + "fixed": "63dd390fab905a239a97e2700532929343ebc4e9" } ] } ], - "versions": 207, + "versions": 337, "database_specific": "" } ], "schema_version": "1.9.0", "credits": [ { - "name": "Muhamad Arga Reksapati", + "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { - "name": "Stefan Eissing", + "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ] }, { - "id": "CURL-CVE-2026-8924", - "summary": "trailing dot domain super cookie", - "details": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.", - "aliases": ["CVE-2026-8924"], + "id": "CURL-CVE-2026-92390", + "summary": "-J no-clobber guarantee bypassed with 103 early hints", + "details": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint.", + "aliases": ["CVE-2026-92390"], "modified": "", - "published": "2026-06-24T08:00:00Z", + "published": "2026-10-14T08:00:00Z", "database_specific": "", "affected": [ { @@ -2579,28 +3339,28 @@ "type": "SEMVER", "events": [ { - "introduced": "7.46.0" + "introduced": "7.20.0" }, { - "fixed": "8.14.2" + "fixed": "8.14.3" }, { "introduced": "8.15.0" }, { - "fixed": "8.16.1" + "fixed": "8.16.2" }, { "introduced": "8.17.0" }, { - "fixed": "8.20.1" + "fixed": "8.20.2" }, { "introduced": "8.21.0" }, { - "fixed": "8.21.0" + "fixed": "8.23.0" } ] }, @@ -2609,37 +3369,37 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "e77b5b7453c1e8ccd7ec0816890d98e2f392e465" + "introduced": "80675818e0417be8c991513b328c5507e93b47e5" }, { - "fixed": "51beed175dbfc37da3113f6acce60c630c070ce8" + "fixed": "c24a69d8cd368de4e25e3540bf0b7b000a31d5a7" } ] } ], - "versions": 201, + "versions": 287, "database_specific": "" } ], "schema_version": "1.9.0", "credits": [ { - "name": "vegagent on hackerone", + "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { - "name": "Daniel Stenberg", + "name": "Joshua Rogers (Aisle Research)", "type": "REMEDIATION_DEVELOPER" } ] }, { - "id": "CURL-CVE-2026-8927", - "summary": "env-set cross-proxy Digest auth state leak", - "details": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", - "aliases": ["CVE-2026-8927"], + "id": "CURL-CVE-2026-92391", + "summary": "curl_mime_free stack overflow by recursion", + "details": "A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process.", + "aliases": ["CVE-2026-92391"], "modified": "", - "published": "2026-06-24T08:00:00Z", + "published": "2026-10-14T08:00:00Z", "database_specific": "", "affected": [ { @@ -2648,28 +3408,28 @@ "type": "SEMVER", "events": [ { - "introduced": "7.12.0" + "introduced": "7.56.0" }, { - "fixed": "8.14.2" + "fixed": "8.14.3" }, { "introduced": "8.15.0" }, { - "fixed": "8.16.1" + "fixed": "8.16.2" }, { "introduced": "8.17.0" }, { - "fixed": "8.20.1" + "fixed": "8.20.2" }, { "introduced": "8.21.0" }, { - "fixed": "8.21.0" + "fixed": "8.23.0" } ] }, @@ -2678,22 +3438,22 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "fc6eff13b5414caf6edf22d73a3239e074a04216" + "introduced": "ce0881edee3c78609eae49665fb70264d8786d29" }, { - "fixed": "5c225384b8d52c67ce8259c6e4203bc57aacb567" + "fixed": "d7546809d5bd548b69ec49fca26565c8f6f0d344" } ] } ], - "versions": 346, + "versions": 173, "database_specific": "" } ], "schema_version": "1.9.0", "credits": [ { - "name": "Ady Elouej", + "name": "Joshua Rogers (Aisle Research)", "type": "FINDER" }, { @@ -2703,12 +3463,12 @@ ] }, { - "id": "CURL-CVE-2026-8932", - "summary": "incomplete mTLS config matching in conn reuse", - "details": "libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key.", - "aliases": ["CVE-2026-8932"], + "id": "CURL-CVE-2026-94266", + "summary": "password leak in CURLINFO_EFFECTIVE_URL", + "details": "libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did.", + "aliases": ["CVE-2026-94266"], "modified": "", - "published": "2026-06-24T08:00:00Z", + "published": "2026-10-14T08:00:00Z", "database_specific": "", "affected": [ { @@ -2717,28 +3477,10 @@ "type": "SEMVER", "events": [ { - "introduced": "7.7" - }, - { - "fixed": "8.14.2" - }, - { - "introduced": "8.15.0" - }, - { - "fixed": "8.16.1" - }, - { - "introduced": "8.17.0" - }, - { - "fixed": "8.20.1" - }, - { - "introduced": "8.21.0" + "introduced": "7.62.0" }, { - "fixed": "8.21.0" + "fixed": "8.23.0" } ] }, @@ -2747,15 +3489,15 @@ "repo": "https://github.com/curl/curl.git", "events": [ { - "introduced": "a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4" + "introduced": "46e164069d1a5230e4e64cbd2ff46c46cce056bb" }, { - "fixed": "7541ae569d82fb308a5e2d94916027da4fa3ba3e" + "fixed": "7a6bd027d0de2b6857472d35da090ef60cc29f19" } ] } ], - "versions": 414, + "versions": 158, "database_specific": "" } ], @@ -2766,7 +3508,7 @@ "type": "FINDER" }, { - "name": "Joshua Rogers (Aisle Research)", + "name": "Daniel Stenberg", "type": "REMEDIATION_DEVELOPER" } ] @@ -4001,7 +4743,8 @@ { "fixed": "cd046f6c93b39d673a58c18648d8906e954c4f5d" } - ] + ], + "database_specific": "" } ], "versions": 64, @@ -4592,7 +5335,8 @@ { "fixed": "ea71c3b6b60e563651ea8596a975aef0c8199519" } - ] + ], + "database_specific": "" } ], "versions": 97, @@ -4668,7 +5412,8 @@ { "fixed": "90325ff0444cbdff368bda5d26d6405a0bb6ee43" } - ] + ], + "database_specific": "" } ], "versions": 211, @@ -4756,7 +5501,8 @@ { "fixed": "f1a39f221d57354990e3eeeddc3404aede2aff70" } - ] + ], + "database_specific": "" } ], "versions": 346, @@ -4832,7 +5578,8 @@ { "fixed": "7103a93b05bc69ea98ed9d05d02fa9eeba533f2f" } - ] + ], + "database_specific": "" } ], "versions": 147, @@ -4925,7 +5672,8 @@ { "fixed": "e3d7401a32a46516c9e5ee877e613e62ed35bddc" } - ] + ], + "database_specific": "" } ], "versions": 221, @@ -6241,7 +6989,8 @@ { "fixed": "5c225384b8d52c67ce8259c6e4203bc57aacb567" } - ] + ], + "database_specific": "" } ], "versions": 345,