Affected: Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

curl-8.21.0-1.1 on GA media

curl: curl: Insecure connection establishment due to TLS configuration mismatch curl: libcurl: Unauthorized connection reuse due to a logical error curl: curl: Cookie injection via malicious HTTP server using super cookies curl: curl: Double-free vulnerability in SASL authentication curl: curl: Information disclosure via incorrect .netrc password lookup curl: Information disclosure due to uncleared proxy authentication state libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials libcurl: libcurl: Use-after-free via curl_easy_pause() in CURLMOPT_SOCKETFUNCTION callback libcurl: libcurl: Information disclosure due to persistent Referer header curl: curl: Man-in-the-middle attack via SSH host key bypass curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability libcurl: libcurl: Certificate validation bypass due to incorrect connection reuse curl: curl: Denial of Service via WebSocket PING flood curl: curl: Information disclosure via incorrect Digest authentication header reuse curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP

Affected: Ubuntu:26.04:LTS: curl

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand oder eine Speicherbeschädigung zu verursachen.