CURL vulnerabilities

CVEs per yearBy the year they were published

1. 20181
2. 20192
3. 20235
4. 202411
5. 202663
6. 202616

Newest CVEs

• CVE-2026-107929

  local interface connection reuse mixup

  curl · curl

  High8.1
• CVE-2026-107928

  info leak uploading over WebSockets with GnuTLS

  curl · curl

  High8.1
• CVE-2026-94266

  password leak in CURLINFO_EFFECTIVE_URL

  curl · curl

  High7.5
• CVE-2026-94265

  Authorization: Negotiate sent to foreign origin

  curl · curl

  Critical9.1
• CVE-2026-92391

  curl_mime_free stack overflow by recursion

  curl · curl

  High7.5
• CVE-2026-92390

  -J no-clobber guarantee bypassed with 103 early hints

  curl · curl

  High7.5
• CVE-2026-92389

  TFTP direction confusion

  curl · curl

  High8.1
• CVE-2026-92388

  FTP wildcard write callback mixup

  curl · curl

  Critical9.1
• CVE-2026-92387

  never-ending loop via server response omission

  curl · curl

  High8.1
• CVE-2026-92386

  server-set cookie aborts cookie jar load

  curl · curl

  High8.1