Skip to content
OpenAdvisories

Package · Debian

curl

222 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 8.1
    CVE-2026-92392 Public exploit

    HTTP/2 upload Use-After-Free

    During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

    curl curl curl curl Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-8932 Public exploit

    incomplete mTLS config matching in conn reuse

    libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them m…

    curl curl curl curl Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-3805 Public exploit

    use after free in SMB connection reuse

    When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.

    curl curl curl curl Debian Ubuntu Alpine
  • Medium 4.8
    CVE-2025-5025 Public exploit

    No QUIC certificate pinning with wolfSSL

    libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, faili…

    curl curl curl curl Debian Alpine
  • High 8.8
    CVE-2023-38545 Public exploit EPSS 78%

    This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…

    curl curl curl curl Debian Ubuntu Alpine
  • High 7.5
    CVE-2023-38039 Public exploit EPSS 56%

    When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl…

    curl curl curl curl Debian Ubuntu Alpine
  • Low 3.7
    CVE-2021-22924 Public exploit

    libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches…

    curl curl curl Debian Ubuntu Alpine
  • Medium 5.4
    CVE-2018-16890 Public exploit

    libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling …

    The curl Project curl curl curl Debian Ubuntu Alpine
  • Unscored —
    CVE-2013-0249 Public exploit EPSS 22%

    Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl …

    curl Debian
  • Unscored —
    CVE-2011-3389 Public exploit EPSS 73%

    The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firef…

    asterisk curl nss bouncycastle Debian
  • Unscored —
    CVE-2009-0037 Public exploit

    The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts ar…

    curl Debian