Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CERTFR-2026-AVI-1307

Vulnerability from certfr_avis - Published: 2026-10-14 - Updated: 2026-10-14

De multiples vulnérabilités ont été découvertes dans Curl. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Curl	cURL et libcurl	Curl versions antérieures à 8.23.0

References

Title

Publication Time

Tags

Bulletin de sécurité Curl CVE-2026-86412	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-107928	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92388	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92386	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86411	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-94265	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87862	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86410	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-107929	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92387	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87864	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87865	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86414	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92392	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87866	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92389	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86409	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92391	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86413	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86415	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-94266	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87863	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87861	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92390	2026-10-14	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Curl versions ant\u00e9rieures \u00e0 8.23.0",
      "product": {
        "name": "cURL et libcurl",
        "vendor": {
          "name": "Curl",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-94265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94265"
    },
    {
      "name": "CVE-2026-87863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87863"
    },
    {
      "name": "CVE-2026-107928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107928"
    },
    {
      "name": "CVE-2026-86414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86414"
    },
    {
      "name": "CVE-2026-86411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86411"
    },
    {
      "name": "CVE-2026-87864",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87864"
    },
    {
      "name": "CVE-2020-8177",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8177"
    },
    {
      "name": "CVE-2026-92392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92392"
    },
    {
      "name": "CVE-2026-86413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86413"
    },
    {
      "name": "CVE-2026-107929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107929"
    },
    {
      "name": "CVE-2026-92389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92389"
    },
    {
      "name": "CVE-2026-87861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87861"
    },
    {
      "name": "CVE-2026-92386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92386"
    },
    {
      "name": "CVE-2026-92387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92387"
    },
    {
      "name": "CVE-2026-12064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12064"
    },
    {
      "name": "CVE-2026-92391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92391"
    },
    {
      "name": "CVE-2026-86410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86410"
    },
    {
      "name": "CVE-2026-86415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86415"
    },
    {
      "name": "CVE-2026-87865",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87865"
    },
    {
      "name": "CVE-2026-87862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87862"
    },
    {
      "name": "CVE-2026-94266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94266"
    },
    {
      "name": "CVE-2026-92388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92388"
    },
    {
      "name": "CVE-2026-86412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86412"
    },
    {
      "name": "CVE-2026-87866",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87866"
    },
    {
      "name": "CVE-2026-92390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92390"
    },
    {
      "name": "CVE-2026-86409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86409"
    }
  ],
  "initial_release_date": "2026-10-14T00:00:00",
  "last_revision_date": "2026-10-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1307",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Curl. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Curl",
  "vendor_advisories": [
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86412",
      "url": "https://curl.se/docs/CVE-2026-86412.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-107928",
      "url": "https://curl.se/docs/CVE-2026-107928.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92388",
      "url": "https://curl.se/docs/CVE-2026-92388.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92386",
      "url": "https://curl.se/docs/CVE-2026-92386.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86411",
      "url": "https://curl.se/docs/CVE-2026-86411.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-94265",
      "url": "https://curl.se/docs/CVE-2026-94265.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87862",
      "url": "https://curl.se/docs/CVE-2026-87862.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86410",
      "url": "https://curl.se/docs/CVE-2026-86410.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-107929",
      "url": "https://curl.se/docs/CVE-2026-107929.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92387",
      "url": "https://curl.se/docs/CVE-2026-92387.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87864",
      "url": "https://curl.se/docs/CVE-2026-87864.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87865",
      "url": "https://curl.se/docs/CVE-2026-87865.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86414",
      "url": "https://curl.se/docs/CVE-2026-86414.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92392",
      "url": "https://curl.se/docs/CVE-2026-92392.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87866",
      "url": "https://curl.se/docs/CVE-2026-87866.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92389",
      "url": "https://curl.se/docs/CVE-2026-92389.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86409",
      "url": "https://curl.se/docs/CVE-2026-86409.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92391",
      "url": "https://curl.se/docs/CVE-2026-92391.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86413",
      "url": "https://curl.se/docs/CVE-2026-86413.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86415",
      "url": "https://curl.se/docs/CVE-2026-86415.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-94266",
      "url": "https://curl.se/docs/CVE-2026-94266.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87863",
      "url": "https://curl.se/docs/CVE-2026-87863.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87861",
      "url": "https://curl.se/docs/CVE-2026-87861.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92390",
      "url": "https://curl.se/docs/CVE-2026-92390.html"
    }
  ]
}

RHSA-2026:82895

Vulnerability from csaf_redhat - Published: 2026-10-14 11:39 - Updated: 2026-10-17 12:55

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

26 vulnerabilities in this advisory, including CVE-2026-92389.

CVE-2026-92389

A flaw was found in curl. When handling Trivial File Transfer Protocol (TFTP) transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive data from prior operations on a reused connection handle to the attacker's server.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 13 products

https://access.redhat.com/errata/RHSA-2026:82895

Open the full advisory

UBUNTU-CVE-2026-92389 (CVE-2026-92389)

Vulnerability from osv_ubuntu – Published: 2026-10-14 06:00 – Updated: 2026-10-14 06:00 – Source website

Details

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent CURLOPT_READDATA pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.

Severity

N/A (UNKNOWN)

low