CVE-2026-86413: Negotiate credentials sent to redirected origin #3993549 Valid No weakness recorded – 2026-10-14 – 4 CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples #4118610 Valid Cryptography Medium 2026-10-26 – 4 passive FTPS data connection handshake blocks curl_multi_perform() with no timeout (regression in 8.19.0) #4122567 Informative Denial of Service Low 2026-10-23 – 4 CVE-2026-111951: curl -OJ truncate without filename #4124849 Valid File and Path Handling Low 2026-10-26 – 4 netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections) #4125043 N/A Authentication Medium 2026-10-26 – 4 CVE-2026-115528: wolfSSL TLS connect without cert #4128428 Valid Cryptography Medium 2026-10-26 – 4 POP3: data after the end-of-body terminator is written into the retrieved message #4132132 N/A Cryptography Medium 2026-10-21 – 4 Active Mixed Content over HTTPS #640532 N/A No weakness recorded Medium 2019-11-01 – 5 CVE-2021-22876: Automatic referer leaks credentials #1101882 Valid No weakness recorded Low 2021-04-30 – 5 CVE-2021-22922: Wrong content via metalink not discarded #1213175 Valid Input Validation and Logic Medium 2021-07-21 – 5 CVE-2021-22924: Bad connection reuse due to flawed path name checks #1223565 Valid Input Validation and Logic High 2021-07-21 – 5 CVE-2021-22926: CURLOPT_SSLCERT mixup with Secure Transport #1234760 Valid Input Validation and Logic Medium 2021-07-21 – 5 Remote memory disclosure vulnerability in libcurl on 64 Bit Windows #1444539 Informative Information Disclosure High 2022-02-21 – 5 CVE-2022-27779: cookie for trailing dot TLD #1553301 Valid Information Disclosure Medium 2022-05-11 – 5 CVE-2022-27781: CERTINFO never-ending busy-loop #1555441 Valid Denial of Service Low 2022-05-16 – 5 Credential leak on redirect #1568175 N/A Authentication Medium 2022-05-14 – 5 curl mishandles `%0c%0b` sequences in HTTP responses leading to CRLF confusions, Headers and Cookies Injection #2861797 N/A Injection and Smuggling – 2025-07-07 – 5 TLS Cipher Misconfiguration in HTTP/3/QUIC Support #2981303 N/A No weakness recorded – 2025-07-06 – 5 Double free in tool_ssls_load() #3431180 Informative Memory Corruption – 2025-11-18 – 5 CRLF Injection / Protocol Smuggling in libcurl via CURLOPT_USERNAME (IMAP) #3479984 N/A Injection and Smuggling Critical 2025-12-28 – 5 CRLF Injection in HTTP header values allows arbitrary header injection #3505557 N/A Injection and Smuggling None 2026-01-10 – 5 Heap Out-of-Bounds Read in lib/http2.c via Malformed PUSH_PROMISE Headers #3506159 N/A Memory Corruption High 2026-01-10 – 5 integer Overflow in MQTT Protocol Handling Allows Bypassing Message Size Limit #3508500 Informative Memory Corruption High 2026-01-13 – 5 SMTP Command Injection via CRLF in libcurl MAIL_FROM / MAIL_RCPT (lib/smtp.c) #3651975 N/A Injection and Smuggling – 2026-04-06 – 5 NULL pointer dereference in libcurl URL API redirect_url() with CURLU_DEFAULT_SCHEME #3736234 Informative Memory Corruption None 2026-05-17 – 5 CVE-2026-10536: HTTP/2 stream-dependency tree UAF #3751697 Valid Memory Corruption Low 2026-06-24 – 5 Use-after-free in `curl_easy_duphandle()` with HTTP/2 stream-dependency tree #3751701 Informative Memory Corruption None 2026-06-01 – 5 Low priority HSTS bypass in curl_easy_duphandle() #3769293 Informative Information Disclosure Low 2026-06-01 – 5 OpenSSL ENGINE selection omitted from mTLS connection matching #3968853 Informative No weakness recorded Low 2026-09-14 – 5 CVE-2026-80231: native CA store conn reuse #3969368 Valid No weakness recorded Low 2026-09-03 – 5 11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes first #3973121 Informative Authentication – 2026-09-07 – 5 57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()` #3973219 Informative Memory Corruption – 2026-09-07 – 5 53: HTTP/1 CONNECT chunked-407 trailers bypass CURLOPT_SUPPRESS_CONNECT_HEADERS and lose CURLH_CONNECT classification #3973234 Informative No weakness recorded – 2026-09-14 – 5 One Strict-Transport-Security response header empties the victim's entire HSTS store, silently, #4007917 N/A Cryptography Medium 2026-10-15 – 5 CVE-2026-107929: local interface connection reuse mixup #4099618 Valid Information Disclosure Low 2026-10-14 – 5 wolfSSL TLS sessions retain native-CA trust after the application narrows trust #4122227 Informative Cryptography Low 2026-10-26 – 5 SCP upload with --crlf sends more bytes than the size declared to the server (same class curl refused for IMAP CVE-2026-87864 and RTSP) #4123654 Informative Injection and Smuggling Low 2026-10-19 – 5 RTSP ANNOUNCE/SET_PARAMETER upload with --use-ascii / CURLOPT_TRANSFERTEXT sends more body bytes than the declared Content-Length (incomplete fix of e #4124486 Informative Injection and Smuggling Low 2026-10-19 – 5 CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth #4124549 N/A Authentication Medium 2026-10-20 – 5 curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode) #4125065 Informative Denial of Service Medium 2026-10-23 – 5 SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections #4126768 N/A Authentication Low 2026-10-19 – 5 urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the host #4127756 N/A Input Validation and Logic Low 2026-10-19 – 5 curl reuses an HTTPS connection when a response is already buffered in the TLS stack #4128703 N/A Cryptography Medium 2026-10-20 – 5 TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another #4129638 N/A Cryptography Medium 2026-10-20 – 5 A server response that answers nothing is used as the next transfer's reply — and with IMAP, a fully compliant server does this by accident #4131903 N/A No weakness recorded Medium 2026-10-22 – 5 Github wikis are editable by anyone #Githubwikistakeover #545052 N/A Access Control Low 2019-05-25 – 6 CVE-2019-5481: krb5: double-free in read_data() after realloc() fail #686823 Valid Memory Corruption Medium 2020-11-14 – 6 SSRF via maliciously crafted URL due to host confusion #704621 Informative Server-Side Request Forgery Critical 2021-01-08 – 6 CVE-2022-22576: OAUTH2 bearer bypass in connection re-use #1526328 Valid Authentication Medium 2022-04-29 – 6 --libcurl code injection via trigraphs #1548535 Informative Command and Code Injection Low 2022-04-24 – 6