Skip to content
OpenAdvisories
Medium WID-SEC-2026-3149 9 CVEs

cURL: Mehrere Schwachstellen

Published Sep 1, 2026 · Updated Nov 12, 2026 · Revision 18 · de

Vendor: amazon Vendor: Fedora Vendor: gentoo Vendor: IBM Vendor: Microsoft Vendor: SUSE Product: AIX Product: Azure Linux Product: Informix Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Platform: iOS Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.

Product

cURL ist eine Client-Software, die das Austauschen von Dateien mittels mehrerer Protokolle wie z. B. HTTP oder FTP erlaubt.

Vulnerabilities 9

  • Critical 9.8
    CVE-2026-19931

    Negotiate ambient user conn reuse

    A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated con…

    curl curl mysql curl Debian Azure Linux Alpine Wolfi
  • Critical 9.1
    CVE-2026-18924

    HTTP/2 server push UAF

    A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.2
    CVE-2026-82209

    domain-scoped PSL domain cookie

    When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80229

    OpenSSL provider use-after-free

    When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80230

    OpenSSL pinning bypass

    When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80231

    native CA store conn reuse

    A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

    curl curl mysql curl Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80255

    secure cookie attribute bypass with tab

    A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-82208

    wolfSSL CA-cache hit overrides callback

    With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the…

    curl curl mysql curl Debian Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-13608

    OpenLDAP SASL authentication bypass

    A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi

Revision history

  1. #18

    Neue Updates von IBM aufgenommen

  2. #17

    Neue Updates von Gentoo aufgenommen

  3. #16

    Neue Updates von SUSE aufgenommen

  4. #15

    Neue Updates von SUSE aufgenommen

  5. #14

    Neue Updates von Fedora aufgenommen

  6. #13

    Neue Updates von IBM aufgenommen

  7. #12

    Neue Updates von Fedora aufgenommen

  8. #11

    Neue Updates von Fedora aufgenommen

  9. #10

    Neue Updates von Fedora aufgenommen

  10. #9

    Neue Updates von Fedora aufgenommen

  11. #8

    Neue Updates von Fedora aufgenommen

  12. #7

    Neue Updates von Amazon aufgenommen

  13. #6

    Neue Updates von SUSE aufgenommen

  14. #5

    Neue Updates von SUSE aufgenommen

  15. #4

    Neue Updates von SUSE aufgenommen

  16. #3

    Neue Updates von openSUSE aufgenommen

  17. #2

    Referenz(en) aufgenommen: EUVD-2026-72164, EUVD-2026-72165, EUVD-2026-72166, EUVD-2026-72168, EUVD-2026-72167, EUVD-2026-72169

  18. #1

    Initiale Fassung

References