Known Vulnerabilities for Libcurl by Curl

Listed below are 4 of the newest known vulnerabilities associated with "Libcurl" by "Curl".

These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.

Data on known vulnerable versions is also displayed based on information from known CPEs

Known Vulnerabilities

CVE Shortened Description Severity Publish Date Last Modified
CVE-2026-94266 json libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, e... Not Provided 2026-10-20 2026-10-20
CVE-2026-92391 json A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal clea... Not Provided 2026-10-20 2026-10-20
CVE-2026-92389 json libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening ... Not Provided 2026-10-20 2026-10-20
CVE-2026-92388 json When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the wr... Not Provided 2026-10-20 2026-10-20
CVE-2026-92387 json By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and ... Not Provided 2026-10-20 2026-10-20
CVE-2026-91766 json When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorizatio... Not Provided 2026-09-25 2026-09-28
CVE-2026-87865 json When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to repor... Not Provided 2026-10-20 2026-10-20
CVE-2026-86415 json libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authe... Not Provided 2026-10-20 2026-10-20
CVE-2026-86414 json An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the... Not Provided 2026-10-20 2026-10-20
CVE-2026-82209 json When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie`... Not Provided 2026-09-06 2026-09-15
Results limited to 10 most recent vulnerabilities

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report