Known Vulnerabilities for products from Haxx
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Haxx".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-12064 json | When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between th... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-11856 json | Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then chang... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-11586 json | By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for ... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-11564 json | libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the s... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-11352 json | An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-10536 json | A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-9547 json | When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` call... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-9546 json | A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-9545 json | In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-9080 json | Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-9079 json | libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old cr... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-8932 json | libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should ha... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-8927 json | When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to c... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-8925 json | The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the po... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-8458 json | libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they ... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-8286 json | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connect... | Not Provided | 2026-07-03 | 2026-07-07 |
| CVE-2026-7168 json | Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then cha... | Not Provided | 2026-05-13 | 2026-05-14 |
| CVE-2026-7009 json | When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that t... | Not Provided | 2026-05-13 | 2026-05-14 |
| CVE-2026-6429 json | When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for... | Not Provided | 2026-05-13 | 2026-05-14 |
| CVE-2026-6276 json | Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using ... | Not Provided | 2026-05-13 | 2026-05-14 |