https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:27:14 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2025-10148 <p><strong>Affected:</strong> Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl</p> <p><strong>Affected:</strong> Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-10148 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0775 certfr-2025-avi-0775 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0775 https://cve.radiocsirt.org/vuln/cleanstart-2026-ay18527 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: curl</p> <p>Multiple security vulnerabilities affect the curl package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: curl</p> <p>Multiple security vulnerabilities affect the curl package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ay18527 https://cve.radiocsirt.org/vuln/cnvd-2025-21413 cnvd-2025-21413 https://cve.radiocsirt.org/vuln/cnvd-2025-21413 https://cve.radiocsirt.org/vuln/euvd-2026-368391 EUVD-2026-368391 https://cve.radiocsirt.org/vuln/euvd-2026-368391 https://cve.radiocsirt.org/vuln/fkie_cve-2025-10148 <p>curl&#39;s WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.</p> <p>A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.</p> <p>curl&#39;s WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.</p> <p>A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-10148 https://cve.radiocsirt.org/vuln/ghsa-cxvq-c3r3-8gwq <p>curl&#39;s websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.</p> <p>A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.</p> <p>curl&#39;s websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.</p> <p>A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.</p> https://cve.radiocsirt.org/vuln/ghsa-cxvq-c3r3-8gwq https://cve.radiocsirt.org/vuln/icsa-26-043-03 <p>When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3. Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. curl&#39;s websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.</p> <p>A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy. The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-mid…</p> <p>When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3. Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. curl&#39;s websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.</p> <p>A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy. The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-mid…</p> https://cve.radiocsirt.org/vuln/icsa-26-043-03 https://cve.radiocsirt.org/vuln/msrc_cve-2025-10148 msrc_CVE-2025-10148 https://cve.radiocsirt.org/vuln/msrc_cve-2025-10148 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15590-1 <p>curl-8.16.0-1.1 on GA media</p> <p>curl-8.16.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15590-1 https://cve.radiocsirt.org/vuln/rhsa-2026:6893 <p>curl: libcurl: Curl out of bounds read for cookie path curl: predictable WebSocket mask curl: Curl missing SFTP host verification with wolfSSH backend curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token curl: libcurl: Improper certificate validation due to cached TLS settings reuse curl: Host verification bypass during SSH transfers curl: libssh key passphrase bypass without agent set curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect curl: curl: Unauthorized access due to improper HTTP proxy connection reuse curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling</p> <p>curl: libcurl: Curl out of bounds read for cookie path curl: predictable WebSocket mask curl: Curl missing SFTP host verification with wolfSSH backend curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token curl: libcurl: Improper certificate validation due to cached TLS settings reuse curl: Host verification bypass during SSH transfers curl: libssh key passphrase bypass without agent set curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect curl: curl: Unauthorized access due to improper HTTP proxy connection reuse curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling</p> https://cve.radiocsirt.org/vuln/rhsa-2026:6893 https://cve.radiocsirt.org/vuln/ssa-089022 <p>There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400. An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. libcurl&#39;s ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `fr…</p> <p>There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400. An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. libcurl&#39;s ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `fr…</p> https://cve.radiocsirt.org/vuln/ssa-089022 https://cve.radiocsirt.org/vuln/suse-su-2025:03173-1 <p>Security update for curl</p> <p>Security update for curl</p> https://cve.radiocsirt.org/vuln/suse-su-2025:03173-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-10148 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: curl, Ubuntu:25.10: curl</p> <p>curl&#39;s WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: curl, Ubuntu:25.10: curl</p> <p>curl&#39;s WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-10148 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2023 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Dateien zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2023