Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CERTFR-2026-AVI-1307

Vulnerability from certfr_avis - Published: 2026-10-14 - Updated: 2026-10-14

De multiples vulnérabilités ont été découvertes dans Curl. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Curl	cURL et libcurl	Curl versions antérieures à 8.23.0

References

Title

Publication Time

Tags

Bulletin de sécurité Curl CVE-2026-86412	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-107928	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92388	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92386	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86411	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-94265	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87862	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86410	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-107929	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92387	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87864	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87865	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86414	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92392	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87866	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92389	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86409	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92391	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86413	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86415	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-94266	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87863	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87861	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92390	2026-10-14	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Curl versions ant\u00e9rieures \u00e0 8.23.0",
      "product": {
        "name": "cURL et libcurl",
        "vendor": {
          "name": "Curl",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-94265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94265"
    },
    {
      "name": "CVE-2026-87863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87863"
    },
    {
      "name": "CVE-2026-107928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107928"
    },
    {
      "name": "CVE-2026-86414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86414"
    },
    {
      "name": "CVE-2026-86411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86411"
    },
    {
      "name": "CVE-2026-87864",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87864"
    },
    {
      "name": "CVE-2020-8177",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8177"
    },
    {
      "name": "CVE-2026-92392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92392"
    },
    {
      "name": "CVE-2026-86413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86413"
    },
    {
      "name": "CVE-2026-107929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107929"
    },
    {
      "name": "CVE-2026-92389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92389"
    },
    {
      "name": "CVE-2026-87861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87861"
    },
    {
      "name": "CVE-2026-92386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92386"
    },
    {
      "name": "CVE-2026-92387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92387"
    },
    {
      "name": "CVE-2026-12064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12064"
    },
    {
      "name": "CVE-2026-92391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92391"
    },
    {
      "name": "CVE-2026-86410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86410"
    },
    {
      "name": "CVE-2026-86415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86415"
    },
    {
      "name": "CVE-2026-87865",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87865"
    },
    {
      "name": "CVE-2026-87862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87862"
    },
    {
      "name": "CVE-2026-94266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94266"
    },
    {
      "name": "CVE-2026-92388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92388"
    },
    {
      "name": "CVE-2026-86412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86412"
    },
    {
      "name": "CVE-2026-87866",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87866"
    },
    {
      "name": "CVE-2026-92390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92390"
    },
    {
      "name": "CVE-2026-86409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86409"
    }
  ],
  "initial_release_date": "2026-10-14T00:00:00",
  "last_revision_date": "2026-10-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1307",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Curl. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Curl",
  "vendor_advisories": [
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86412",
      "url": "https://curl.se/docs/CVE-2026-86412.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-107928",
      "url": "https://curl.se/docs/CVE-2026-107928.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92388",
      "url": "https://curl.se/docs/CVE-2026-92388.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92386",
      "url": "https://curl.se/docs/CVE-2026-92386.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86411",
      "url": "https://curl.se/docs/CVE-2026-86411.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-94265",
      "url": "https://curl.se/docs/CVE-2026-94265.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87862",
      "url": "https://curl.se/docs/CVE-2026-87862.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86410",
      "url": "https://curl.se/docs/CVE-2026-86410.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-107929",
      "url": "https://curl.se/docs/CVE-2026-107929.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92387",
      "url": "https://curl.se/docs/CVE-2026-92387.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87864",
      "url": "https://curl.se/docs/CVE-2026-87864.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87865",
      "url": "https://curl.se/docs/CVE-2026-87865.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86414",
      "url": "https://curl.se/docs/CVE-2026-86414.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92392",
      "url": "https://curl.se/docs/CVE-2026-92392.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87866",
      "url": "https://curl.se/docs/CVE-2026-87866.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92389",
      "url": "https://curl.se/docs/CVE-2026-92389.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86409",
      "url": "https://curl.se/docs/CVE-2026-86409.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92391",
      "url": "https://curl.se/docs/CVE-2026-92391.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86413",
      "url": "https://curl.se/docs/CVE-2026-86413.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86415",
      "url": "https://curl.se/docs/CVE-2026-86415.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-94266",
      "url": "https://curl.se/docs/CVE-2026-94266.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87863",
      "url": "https://curl.se/docs/CVE-2026-87863.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87861",
      "url": "https://curl.se/docs/CVE-2026-87861.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92390",
      "url": "https://curl.se/docs/CVE-2026-92390.html"
    }
  ]
}

RHSA-2026:82895

Vulnerability from csaf_redhat - Published: 2026-10-14 11:39 - Updated: 2026-10-17 12:55

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

26 vulnerabilities in this advisory, including CVE-2026-87864.

CVE-2026-87864

A flaw was found in curl. When curl is configured to perform carriage return and line feed (CRLF) conversion during an Internet Message Access Protocol (IMAP) append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the advertised length as message data, it interprets the remaining overflow bytes as subsequent commands. An attacker capable of supplying message data with line breaks can exploit this issue to execute unauthorized IMAP commands within an authenticated session.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Fixed: 13 products

https://access.redhat.com/errata/RHSA-2026:82895

Open the full advisory

UBUNTU-CVE-2026-87864 (CVE-2026-87864)

Vulnerability from osv_ubuntu – Published: 2026-10-14 06:00 – Updated: 2026-10-14 06:00 – Source website

Details

Enabling CURLOPT_CRLF causes curl to advertise the raw input byte count in the IMAP APPEND {N} literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.

Severity

N/A (UNKNOWN)

low