Skip to main content

libcurl CVE-2026-8932

| EUVDEUVD-2026-41509 HIGH
Authentication Bypass by Primary Weakness (CWE-305)
2026-06-24 GHSA-m7xm-hf59-w6rj
Information Disclosure Curl Haxx
7.5
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    App reuses libcurl handle to same host
  2. Delivery
    Change client cert/private key mid-session
  3. Exploit
    Reuse check ignores private-key options
  4. Execution
    Stale pooled connection reused
  5. Impact
    Transfer sent under wrong mTLS identity

Vulnerability Assessment

Weakness
CWE
CWE-305
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Primary weakness mitigation
Exploitation Conditions

Exploitation requires an application that reuses a single libcurl handle (or a shared connection pool) for multiple transfers to the same origin AND changes the client-certificate/private-key options between those transfers - specifically the private-key-related mTLS settings excluded from the connection-match check - while the target host uses mutual TLS so the mismatched identity is meaningful. What limits exploitation: it does not occur in the common case where mTLS client credentials stay constant for the lifetime of the handle; it requires the vulnerable reuse pattern inside one process rather than any network-side attacker action; and both transfers must target a connection-poolable same-host endpoint. There is no user-interaction or authentication trigger available to an external party - the fault is internal to how the client is driven.
Impact

The signals are consistent in pointing to a low-to-moderate real-world priority despite the 7.5 base score. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) yields High integrity impact with no confidentiality or availability effect, matching the nature of the bug: a transfer is sent under the wrong client identity rather than data being leaked or destroyed. EPSS is very low (0.13%, 3rd percentile), there is no KEV listing, and no public exploit is identified, so this is not an urgent widespread-exploitation scenario. Notably, the CVSS AV:N/AC:L/PR:N framing overstates attacker control: exploitation is not a remote attacker sending a crafted packet but an application reusing a libcurl handle across transfers with differing client certificates, which is application-behavior-dependent - verify against your own usage before treating the network vector literally. In short, a genuine correctness/security bug worth patching on the normal cycle, not an emergency for most deployments.
Exploit ScenarioDerived

An application or scripted curl usage performs multiple HTTPS transfers over a reused libcurl handle to the same host, switching the client certificate/private key between requests to represent different users or tenants. Because the private-key options are excluded from the reuse check, libcurl silently reuses the first connection, so a later transfer is delivered over a session authenticated with the previous identity's certificate. No public exploit is identified at time of analysis; the condition is triggered by legitimate-but-varying client-certificate configuration rather than by an external attacker's payload.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jul 06, 2026

Incorrect mTLS connection reuse in libcurl (curl releases through 8.16.0) causes the library to reuse a pooled TLS connection even after client-certificate options - notably the private key - were changed in a way that should have forced a fresh handshake. Because those client-certificate settings were omitted from the connection-match logic, a later transfer can be sent over a connection authenticated with the wrong client identity, an integrity failure tagged as information disclosure. Rated CVSS 7.5 (C:N/I:H/A:N); EPSS is only 0.13% and there is no public exploit identified at time of analysis, though a HackerOne report (#3733910) drove the private disclosure.

Earlier versions of this analysis (4)
v4 Jul 06, 2026 - 18:47 cvss changed CVSS 7.5

Client-certificate identity confusion in libcurl (curl 7.7 through 8.20.0) lets a pooled TLS connection be reused for a subsequent transfer even after the application changed mTLS options — notably the private key — that should have forced a fresh handshake. Because private-key-related settings were omitted from the connection-reuse match checks, a transfer intended to authenticate with one client certificate/key can silently ride an existing connection authenticated with a different identity. No public exploit identified at time of analysis and CISA KEV does not list it; EPSS is low at 0.13% (3rd percentile), consistent with an app-behavior-dependent logic flaw rather than a mass-exploited bug.

v3 Jul 06, 2026 - 18:45 cvss changed CVSS 7.5

Improper connection reuse in libcurl (curl versions up to 8.20.0) allows a client-certificate–authenticated transfer to be silently sent over a pooled connection established with different mTLS private-key settings. Because libcurl's connection-match logic omitted several client-certificate/private-key options, a subsequent transfer intended to use new key material may instead reuse an existing connection authenticated with the old identity, undermining transfer integrity. There is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is very low (0.13%), consistent with a subtle logic/integrity defect rather than a remotely weaponizable flaw.

v2 Jul 06, 2026 - 18:45 cvss changed CVSS 7.5

Incorrect connection reuse in libcurl (curl) causes it to reuse a pooled TLS connection even after client-certificate options - notably the private key (e.g. CURLOPT_SSLKEY/SSLKEY_BLOB) - were changed in a way that should have forced a new connection. Applications performing mutual-TLS (mTLS) transfers can therefore send requests over a connection authenticated with a different client identity than the one configured for that transfer, undermining integrity of the authenticated session. No public exploit identified at time of analysis; EPSS is very low (0.13%, 3rd percentile) and the flaw is not in CISA KEV.

v1 Jun 24, 2026 - 18:23

Incomplete mTLS configuration matching in libcurl's connection reuse logic allows a pooled connection established with mutual TLS client certificate configuration to be reused for subsequent transfers that carry different mTLS settings, effectively bypassing the intended client authentication posture. This affects applications using libcurl that dynamically change mTLS configuration across multiple requests on the same easy handle or within a connection pool. Rated LOW severity by the curl project and no public exploit or CISA KEV listing has been identified at time of analysis.

RemediationAI

Upgrade libcurl to the fixed release announced in the curl project advisory at https://curl.se/docs/CVE-2026-8932.html; the provided input does not contain the exact patched version string, so treat the curl.se advisory and its JSON as the source of truth for the fixed version rather than an invented number - Patch available per vendor advisory, released patched version not independently confirmed from the provided data. As a compensating control until you can upgrade, avoid reusing the same libcurl easy/multi handle across transfers that use different client certificates or private keys, and instead use a fresh handle (or a separate connection cache) per client-certificate identity, which forces a clean handshake at the cost of losing connection-reuse performance. Applications that never change mTLS client-certificate options at runtime are effectively unaffected. Additional context is in the oss-security post at https://seclists.org/oss-sec/2026/q2/1012.

Affected VersionsENISA

curl 7.65.2 ≤7.65.2
curl 8.7.0 ≤8.7.0
curl 7.44.0 ≤7.44.0
curl 7.9.7 ≤7.9.7
curl 7.9.8 ≤7.9.8
curl 7.10.1 ≤7.10.1
curl 8.7.1 ≤8.7.1
curl 7.19.7 ≤7.19.7
curl 7.54.1 ≤7.54.1
curl 8.16.0 ≤8.16.0
curl 7.84.0 ≤7.84.0
curl 7.37.1 ≤7.37.1
curl 7.65.1 ≤7.65.1
curl 7.18.0 ≤7.18.0
curl 7.30.0 ≤7.30.0
curl 7.51.0 ≤7.51.0
curl 7.68.0 ≤7.68.0
curl 7.31.0 ≤7.31.0
curl 7.47.1 ≤7.47.1
curl 8.9.1 ≤8.9.1
curl 8.2.0 ≤8.2.0
curl 8.14.0 ≤8.14.0
curl 7.15.4 ≤7.15.4
curl 7.7.2 ≤7.7.2
curl 7.10.4 ≤7.10.4
curl 7.88.0 ≤7.88.0
curl 7.71.1 ≤7.71.1
curl 8.12.0 ≤8.12.0
curl 7.16.2 ≤7.16.2
curl 7.21.2 ≤7.21.2
curl 8.0.0 ≤8.0.0
curl 7.77.0 ≤7.77.0
curl 8.19.0 ≤8.19.0
curl 7.16.3 ≤7.16.3
curl 7.88.1 ≤7.88.1
curl 7.21.6 ≤7.21.6
curl 7.21.0 ≤7.21.0
curl 7.9.6 ≤7.9.6
curl 7.59.0 ≤7.59.0
curl 7.49.0 ≤7.49.0
curl 7.14.1 ≤7.14.1
curl 7.39.0 ≤7.39.0
curl 7.9 ≤7.9
curl 7.32.0 ≤7.32.0
curl 8.4.0 ≤8.4.0
curl 7.18.2 ≤7.18.2
curl 7.54.0 ≤7.54.0
curl 7.25.0 ≤7.25.0
curl 7.34.0 ≤7.34.0
curl 7.69.1 ≤7.69.1
curl 8.12.1 ≤8.12.1
curl 8.1.2 ≤8.1.2
curl 7.69.0 ≤7.69.0
curl 7.23.1 ≤7.23.1
curl 7.47.0 ≤7.47.0
curl 7.21.7 ≤7.21.7
curl 7.23.0 ≤7.23.0
curl 7.12.2 ≤7.12.2
curl 7.21.4 ≤7.21.4
curl 8.10.1 ≤8.10.1
curl 7.65.3 ≤7.65.3
curl 7.81.0 ≤7.81.0
curl 7.57.0 ≤7.57.0
curl 7.15.0 ≤7.15.0
curl 7.79.0 ≤7.79.0
curl 7.10.7 ≤7.10.7
curl 7.86.0 ≤7.86.0
curl 7.17.0 ≤7.17.0
curl 7.36.0 ≤7.36.0
curl 7.64.0 ≤7.64.0
curl 7.16.4 ≤7.16.4
curl 7.12.1 ≤7.12.1
curl 7.7 ≤7.7
curl 7.10.5 ≤7.10.5
curl 8.9.0 ≤8.9.0
curl 8.2.1 ≤8.2.1
curl 7.49.1 ≤7.49.1
curl 8.8.0 ≤8.8.0
curl 7.26.0 ≤7.26.0
curl 7.8 ≤7.8
curl 7.87.0 ≤7.87.0
curl 8.14.1 ≤8.14.1
curl 7.65.0 ≤7.65.0
curl 7.85.0 ≤7.85.0
curl 7.13.2 ≤7.13.2
curl 7.13.1 ≤7.13.1
curl 7.46.0 ≤7.46.0
curl 7.42.0 ≤7.42.0
curl 7.42.1 ≤7.42.1
curl 7.10 ≤7.10
curl 7.27.0 ≤7.27.0
curl 7.19.6 ≤7.19.6
curl 8.15.0 ≤8.15.0
curl 7.19.1 ≤7.19.1
curl 8.3.0 ≤8.3.0
curl 7.55.1 ≤7.55.1
curl 7.7.1 ≤7.7.1
curl 7.19.0 ≤7.19.0
curl 8.11.0 ≤8.11.0
curl 8.1.1 ≤8.1.1
curl 7.58.0 ≤7.58.0
curl 7.83.1 ≤7.83.1
curl 7.40.0 ≤7.40.0
curl 7.9.1 ≤7.9.1
curl 7.19.5 ≤7.19.5
curl 7.82.0 ≤7.82.0
curl 7.50.1 ≤7.50.1
curl 7.16.0 ≤7.16.0
curl 7.67.0 ≤7.67.0
curl 7.8.1 ≤7.8.1
curl 7.11.2 ≤7.11.2
curl 7.15.3 ≤7.15.3
curl 7.48.0 ≤7.48.0
curl 7.52.0 ≤7.52.0
curl 8.18.0 ≤8.18.0
curl 7.12.3 ≤7.12.3
curl 7.35.0 ≤7.35.0
curl 7.63.0 ≤7.63.0
curl 7.53.0 ≤7.53.0
curl 7.78.0 ≤7.78.0
curl 7.83.0 ≤7.83.0
curl 7.66.0 ≤7.66.0
curl 7.10.3 ≤7.10.3
curl 7.28.0 ≤7.28.0
curl 7.55.0 ≤7.55.0
curl 7.70.0 ≤7.70.0
curl 7.13.0 ≤7.13.0
curl 7.72.0 ≤7.72.0
curl 7.80.0 ≤7.80.0
curl 8.1.0 ≤8.1.0
curl 7.15.5 ≤7.15.5
curl 7.75.0 ≤7.75.0
curl 8.6.0 ≤8.6.0
curl 7.61.1 ≤7.61.1
curl 7.73.0 ≤7.73.0
curl 7.60.0 ≤7.60.0
curl 7.79.1 ≤7.79.1
curl 7.62.0 ≤7.62.0
curl 7.61.0 ≤7.61.0
curl 7.19.2 ≤7.19.2
curl 8.13.0 ≤8.13.0
curl 7.21.3 ≤7.21.3
curl 7.9.5 ≤7.9.5
curl 7.29.0 ≤7.29.0
curl 8.0.1 ≤8.0.1
curl 7.50.2 ≤7.50.2
curl 7.18.1 ≤7.18.1
curl 8.11.1 ≤8.11.1
curl 7.24.0 ≤7.24.0
curl 7.19.3 ≤7.19.3
curl 7.76.0 ≤7.76.0
curl 7.22.0 ≤7.22.0
curl 7.20.1 ≤7.20.1
curl 7.53.1 ≤7.53.1
curl 7.11.1 ≤7.11.1
curl 7.21.1 ≤7.21.1
curl 7.41.0 ≤7.41.0
curl 7.9.4 ≤7.9.4
curl 7.11.0 ≤7.11.0
curl 7.37.0 ≤7.37.0
curl 7.21.5 ≤7.21.5
curl 8.17.0 ≤8.17.0
curl 7.76.1 ≤7.76.1
curl 7.19.4 ≤7.19.4
curl 7.45.0 ≤7.45.0
curl 7.9.2 ≤7.9.2
curl 7.12.0 ≤7.12.0
curl 7.20.0 ≤7.20.0
curl 7.14.0 ≤7.14.0
curl 7.38.0 ≤7.38.0
curl 7.10.2 ≤7.10.2
curl 7.7.3 ≤7.7.3
curl 7.52.1 ≤7.52.1
curl 8.20.0 ≤8.20.0
curl 7.56.1 ≤7.56.1
curl 7.64.1 ≤7.64.1
curl 8.5.0 ≤8.5.0
curl 7.33.0 ≤7.33.0
curl 7.50.3 ≤7.50.3
curl 7.10.8 ≤7.10.8
curl 7.9.3 ≤7.9.3
curl 7.56.0 ≤7.56.0
curl 7.10.6 ≤7.10.6
curl 7.15.2 ≤7.15.2
curl 7.17.1 ≤7.17.1
curl 7.15.1 ≤7.15.1
curl 7.50.0 ≤7.50.0
curl 7.74.0 ≤7.74.0
curl 7.43.0 ≤7.43.0
curl 8.10.0 ≤8.10.0
curl 7.71.0 ≤7.71.0
curl 7.16.1 ≤7.16.1
curl 7.28.1 ≤7.28.1

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in libcurl's connection-pool reuse mechanism. libcurl keeps established connections in a pool so subsequent transfers on the same easy/multi handle can skip the TCP and TLS handshakes, gated by a configuration-match check that compares the security-relevant transfer settings. This vulnerability is a match-check omission: several TLS client-certificate options - specifically those governing the private key (the SSL key/cert file or blob and related mTLS settings such as CURLOPT_SSLKEY / CURLOPT_SSLCERT and their derivatives) - were not included in the comparison, so two setups differing only in their mTLS client credentials are treated as identical and the older connection is reused. No CWE is assigned in the input, but the root cause is an incomplete comparison of security-relevant state (an incorrect-comparison weakness, akin to CWE-697) leading to use of a connection carrying an unintended authentication context. No CPE strings were provided in the input, so exact product matching should be taken from the NVD/curl JSON.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vuln.today AI 5.9 MEDIUM

Integrity-only impact from using the wrong mTLS identity (I:H, C:N/A:N); AC:H because it needs the specific handle-reuse-with-changed-client-cert pattern, with no attacker privileges or interaction required.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat 7.5 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Jul 06, 2026 - 18:48 vuln.today
v5 - CVSS changed
Analysis Updated
Jul 06, 2026 - 18:47 vuln.today
v4 - CVSS changed
Analysis Updated
Jul 06, 2026 - 18:45 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 06, 2026 - 18:45 vuln.today
v2 - CVSS changed
CVSS changed
Jul 06, 2026 - 18:22 NVD
7.5 (HIGH)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

libcurl, a foundational library used across enterprise APIs and integrations, contains a vulnerability where authenticated connections are inappropriately reused across requests with different client certificates, breaking the identity assurance expected in mutual TLS deployments. No public exploit identified at time of analysis, but organizations using libcurl for certificate-based API security face the risk of requests being routed as an unintended client, compromising access controls and audit integrity. Any enterprise deploying this library should immediately assess and remediate this authentication gap.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: Disable connection pooling in libcurl by setting CURLOPT_FRESH_CONNECT=1 or equivalent to prevent cross-certificate connection reuse; implement more frequent client certificate rotation cycles; monitor API access logs for unexpected client identity mismatches. Subscribe to libcurl security notifications and apply patched versions immediately upon release.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
Ubiquitous
curl/libcurl ships in nearly every OS, container, and networked app
Threat Intel
1
1 sources
Social Media
2
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-305 – Authentication Bypass by Primary Weakness

View all
CVE-2025-31161 CRITICAL POC
9.8
CVE-2026-81578 HIGH POC
8.8
CVE-2024-50478 CRITICAL
9.8
CVE-2023-34124 CRITICAL POC
9.8
CVE-2023-1307 CRITICAL POC
9.8
CVE-2023-0777 CRITICAL POC
9.8
CVE-2022-2651 CRITICAL POC
9.8
CVE-2026-25555 CRITICAL POC
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-293-05
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:29017 ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-8932 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://vuldb.com/vuln/376074 REF https://curl.se/docs/CVE-2026-8932.html REF https://curl.se/docs/CVE-2026-8932.json REF https://hackerone.com/reports/3733910

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy