Known Vulnerabilities for products from Haxx
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Haxx".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-82209 json | When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie`... | Not Provided | 2026-09-06 | 2026-09-15 |
| CVE-2026-82208 json | With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, lib... | Not Provided | 2026-09-06 | 2026-09-15 |
| CVE-2026-80255 json | A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secu... | Not Provided | 2026-09-06 | 2026-09-15 |
| CVE-2026-80231 json | A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different ... | Not Provided | 2026-09-06 | 2026-09-15 |
| CVE-2026-80230 json | When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPE... | Not Provided | 2026-09-06 | 2026-09-15 |
| CVE-2026-80229 json | When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles.... | Not Provided | 2026-09-06 | 2026-09-15 |
| CVE-2026-19931 json | A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when t... | Not Provided | 2026-09-06 | 2026-09-15 |
| CVE-2026-18924 json | A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other han... | Not Provided | 2026-09-06 | 2026-09-15 |
| CVE-2026-13608 json | A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted a... | Not Provided | 2026-09-06 | 2026-09-15 |
| CVE-2026-12064 json | When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between th... | Not Provided | 2026-07-03 | 2026-09-15 |
| CVE-2026-11856 json | Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then chang... | Not Provided | 2026-07-03 | 2026-09-15 |
| CVE-2026-11586 json | By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for ... | Not Provided | 2026-07-03 | 2026-09-15 |
| CVE-2026-11564 json | libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the s... | Not Provided | 2026-07-03 | 2026-09-15 |
| CVE-2026-11352 json | An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against... | Not Provided | 2026-07-03 | 2026-09-15 |
| CVE-2026-10536 json | A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT... | Not Provided | 2026-07-03 | 2026-09-15 |
| CVE-2026-9547 json | When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` call... | Not Provided | 2026-07-03 | 2026-09-15 |
| CVE-2026-9546 json | A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation... | Not Provided | 2026-07-03 | 2026-09-15 |
| CVE-2026-9545 json | In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to... | Not Provided | 2026-07-03 | 2026-09-15 |
| CVE-2026-9080 json | Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability... | Not Provided | 2026-07-03 | 2026-09-15 |
| CVE-2026-9079 json | libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old cr... | Not Provided | 2026-07-03 | 2026-09-15 |