https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:53:43 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-13608 <p><strong>Affected:</strong> Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl</p> <p><strong>Affected:</strong> Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-13608 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1108 certfr-2026-avi-1108 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1108 https://cve.radiocsirt.org/vuln/euvd-2026-368406 EUVD-2026-368406 https://cve.radiocsirt.org/vuln/euvd-2026-368406 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13608 <p>A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.</p> <p>A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-13608 https://cve.radiocsirt.org/vuln/ghsa-3968-82gf-vhpr <p>A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.</p> <p>A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.</p> https://cve.radiocsirt.org/vuln/ghsa-3968-82gf-vhpr https://cve.radiocsirt.org/vuln/msrc_cve-2026-13608 msrc_CVE-2026-13608 https://cve.radiocsirt.org/vuln/msrc_cve-2026-13608 https://cve.radiocsirt.org/vuln/oesa-2026-4126 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: curl</p> <p>cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es):</p> <p>Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.(CVE-2026-11856)</p> <p>A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)</p> <p>A flaw in libcurl&amp;apos;s handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)</p> <p>A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B&amp;apos;s request get sent over user A&amp;apos;s previously authenticated connection.(CVE-2026-19931)</p> <p>When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: curl</p> <p>cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es):</p> <p>Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.(CVE-2026-11856)</p> <p>A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)</p> <p>A flaw in libcurl&amp;apos;s handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)</p> <p>A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B&amp;apos;s request get sent over user A&amp;apos;s previously authenticated connection.(CVE-2026-19931)</p> <p>When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4126 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11696-1 <p>curl-8.22.0-1.1 on GA media</p> <p>curl-8.22.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11696-1 https://cve.radiocsirt.org/vuln/rhsa-2026:63161 <p>curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication curl: curl: Public key pinning bypass allows unauthenticated connections curl: curl: Incorrect HTTPS connection reuse with Native CA Store curl: curl: Information disclosure due to secure cookie attribute bypass curl: libcurl: Information disclosure via improper Public Suffix List boundary check</p> <p>curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication curl: curl: Public key pinning bypass allows unauthenticated connections curl: curl: Incorrect HTTPS connection reuse with Native CA Store curl: curl: Information disclosure due to secure cookie attribute bypass curl: libcurl: Information disclosure via improper Public Suffix List boundary check</p> https://cve.radiocsirt.org/vuln/rhsa-2026:63161 https://cve.radiocsirt.org/vuln/suse-su-2026:23498-1 <p>Security update for curl</p> <p>Security update for curl</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23498-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-13608 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: curl, Ubuntu:26.04:LTS: curl</p> <p>A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: curl, Ubuntu:26.04:LTS: curl</p> <p>A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-13608 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3149 <p>Ein entfernter Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.</p> <p>Ein entfernter Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3149