Most recent entries from all

bdu:2026-09778

BELL-CVE-2026-7168

Affected: Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl

certfr-2026-avi-0514 — De multiples vulnérabilités ont été découvertes dans Curl. Elles permettent à un attaquant de provoquer une atteinte à…

certfr-2026-avi-0514

EUVD-2026-368419

fkie_cve-2026-7168

Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.

GHSA-v92m-hrhj-gw54

msrc_CVE-2026-7168 — cross-proxy Digest auth state leak

msrc_CVE-2026-7168

OESA-2026-2451 — curl security update

Affected: openEuler:22.03-LTS-SP4: curl

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es):

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.(CVE-2026-4873)

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials.

An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's creden…

openSUSE-SU-2026:21774-1 — Security update for curl

Security update for curl

RHSA-2026:19106 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

curl: Curl: Certificate validation bypass due to OCSP stapling flaw curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse

SUSE-SU-2026:23350-1 — Security update for curl

Security update for curl

UBUNTU-CVE-2026-7168

Affected: Ubuntu:Pro:18.04:LTS: curl, Ubuntu:Pro:20.04:LTS: curl, Ubuntu:22.04:LTS: curl, Ubuntu:24.04:LTS: curl, Ubuntu:25.10: curl, Ubuntu:26.04:LTS: curl

WID-SEC-W-2026-1307 — cURL: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.