CU
Product
curl
84
CVEs
0
On KEV
9.8
Max CVSS
24
New 30D
Severity mix
Critical 11High 24Medium 17Low 5
Watch
Add curl to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-2398 | 8.6 | Mar 27 | HTTP/2 push headers memory-leak Affected: 8.6.0 through 8.6.0; 8.5.0 through 8.5.0; 8.4.0 through 8.4.0; 8.3.0 through 8.3.0; 8.2.1 through 8.2.1; 8.2.0 through 8.2.0; +34 more |
| CVE-2026-82209 | 8.2 | Sep 6 | domain-scoped PSL domain cookie Affected: 7.46.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 8.21.0 before 8.22.0; e77b5b7453c1e8ccd7ec0816890d98e2f392e465 before 95c1e8915dce64606bd753fd47fc0bd236e31cd6; 8.21.0; +34 more |
| CVE-2026-92392 | 8.1 | Oct 14 | HTTP/2 upload Use-After-Free Affected: 8.22.0 through 8.22.0; 8.21.0 through 8.21.0; 8.20.0 through 8.20.0; 8.19.0 through 8.19.0; 8.18.0 through 8.18.0; 8.17.0 through 8.17.0; +7 more |
| CVE-2026-8286 | 8.1 | Jul 3 | wrong STARTTLS connection reuse Affected: 7.30.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; a1701eea289fe7ea80651f801cf992838a491dde before a86efdd7ca5433de9231e650f18247de8319ad16; 8.20.0; 8.19.0; +34 more |
| CVE-2019-5436 | 7.8 | May 28 | A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1 Affected: Fixed in 7.65.0 |
| CVE-2026-82208 | 7.5 | Sep 6 | wolfSSL CA-cache hit overrides callback Affected: 8.9.1 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 8.21.0 before 8.22.0; 0f2876b2c33f6784a27b6f7345bd8cd95b46352a before ed0338befd1d865a8ea1fbaa90013a096dedd07a; 8.21.0; +16 more |
| CVE-2026-80255 | 7.5 | Sep 6 | secure cookie attribute bypass with tab Affected: 8.13.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 8.21.0 before 8.22.0; 1aea05a6c2699e80c75936d58569851555acd603 before 4f6aa41a0145e930e766775dbe860883d350aa0a; 8.21.0; +9 more |
| CVE-2026-80231 | 7.5 | Sep 6 | native CA store conn reuse Affected: 7.71.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 8.21.0 before 8.22.0; 148534db57dda611cf8516e92e4d6e35fc1e5074 before 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42; 8.21.0; +34 more |
| CVE-2026-80230 | 7.5 | Sep 6 | OpenSSL pinning bypass Affected: 7.45.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 8.21.0 before 8.22.0; 8363656cb4e0c60a11d8531ead0ec43120b50591 before 5267ed859d545534d0c21675a2b70af5a3b6e3ef; 8.21.0; +34 more |
| CVE-2026-80229 | 7.5 | Sep 6 | OpenSSL provider use-after-free Affected: 8.14.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 8.21.0 before 8.22.0; f2ce6c46b9dcc46ced0ce43fa95176ea7599a854 before 7ea37abc6ac0120ba5f6d94be8d196f7cf1506bb; 8.21.0; +8 more |
| CVE-2026-9546 | 7.5 | Jul 3 | sending old referer Affected: 8.18.0 before 8.20.1; 2cb868242dc2ac9cd52ee64987ef51d5964a56f9 before 862e8a74a84478d82973471b4f49dc2746c1780e; 8.20.0; 8.19.0; 8.18.0 |
| CVE-2026-9545 | 7.5 | Jul 3 | exposing HTTP/3 early data Affected: 8.11.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 962097b8dd44ed5b9e7984bc1cdffdbdd566857f before 7b9613fa9b1a5e04301a3920eef58e8138dad05e; 8.20.0; 8.19.0; +11 more |
| CVE-2026-8932 | 7.5 | Jul 3 | incomplete mTLS config matching in conn reuse Affected: 7.7.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4 before 7541ae569d82fb308a5e2d94916027da4fa3ba3e; 8.20.0; 8.19.0; +34 more |
| CVE-2026-12064 | 7.5 | Jul 3 | proto-default skips SSH verification Affected: 7.81.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 18270893abdb19f0ca170c118f8a2847dbd304be before ab3bb8cd8be8f9d4acb97da0418abc279182041e; 8.20.0; 8.19.0; +34 more |
| CVE-2026-11586 | 7.5 | Jul 3 | WS Auto-PONG memory exhaustion Affected: 8.16.0 before 8.16.1; 8.17.0 before 8.20.1; 0b091328773c64e23f5c4739da74527093c6a5ab before 849317ff5c5a5e13f50ec3d001e46ddffa77d8a4; 8.20.0; 8.19.0; 8.18.0; +2 more |
| CVE-2026-11352 | 7.5 | Jul 3 | QUIC zero-length UDP datagrams busy-loop Affected: 8.18.0 before 8.20.1; 6a3d0b6d631d5e9bec797306b5b41a9f440a088d before 56eca2afb4806f1032872fa97d1834b3c1385276; 8.20.0; 8.19.0; 8.18.0 |
| CVE-2026-6276 | 7.5 | May 13 | stale custom cookie host causes cookie leak Affected: 7.71.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.0; e15e51384a423be31318b3c9c7d612a1aae661fd before 3a19987a87f393d9394fe5acc7643f6c263c92db; 8.19.0; 8.18.0; +34 more |
| CVE-2026-5773 | 7.5 | May 13 | wrong reuse of SMB connection Affected: 7.40.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.0; aec2e865f06669b9cb5d26cc1148d70bc418b163 before 74a169575d6412dc0ff532acdf94de35a6c2a571; 8.19.0; 8.18.0; +34 more |
| CVE-2026-3805 | 7.5 | Mar 11 | use after free in SMB connection reuse Affected: 8.13.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.19.0; f4831daa9b2a97e8a2921d6b62cc4dfdd0d8646e before e090be9f73a7a71459ef678c7cc4b1f75e3ea883; 8.18.0; 8.17.0; +5 more |
| CVE-2026-13608 | 7.4 | Sep 6 | OpenLDAP SASL authentication bypass Affected: 7.82.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 8.21.0 before 8.22.0; eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4 before ea71c3b6b60e563651ea8596a975aef0c8199519; 8.21.0; +34 more |
| CVE-2026-9547 | 7.4 | Jul 3 | SSH improper host validation Affected: 7.69.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 507cf6a13db0375eadd4655b4c64710db29e9cf2 before 0b8dbbc63c98777e4584cb9fbd71df3464008ad1; 8.20.0; 8.19.0; +34 more |
| CVE-2026-9080 | 7.3 | Jul 3 | UAF after pause in socket callback Affected: 8.13.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; cfc657a48dbafb4194676d4c9d841388b3a22210 before 5ab34cba42e4ee4282fe8bab43f311d51b9bf9bd; 8.20.0; 8.19.0; +7 more |
| CVE-2025-0725 | 7.3 | Feb 5 | gzip integer overflow Affected: 8.11.1 through 8.11.1; 8.11.0 through 8.11.0; 8.10.1 through 8.10.1; 8.10.0 through 8.10.0; 8.9.1 through 8.9.1; 8.9.0 through 8.9.0; +34 more |
| CVE-2025-0665 | 7.0 | Feb 5 | eventfd double close Affected: 8.11.1 through 8.11.1 |
Showing 24