Technology · Curl
Curl vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 21 vulnerabilities in Curl: 0 in the last 7 days and 21 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-94266, was published on 20 October 2026. 21 vulnerabilities in the last four weeks, up from none in the four before.
- Last 7 days
- 0
- Last 90 days
- 21
- Critical, all time
- 0
- Exploited in the wild
- 0
About Curl
Command-line utility and library for retrieving content from URLs using various protocols.
Latest Curl vulnerabilities
- CVE-2026-94266: libcurl credentials leak in CURLINFO_EFFECTIVE_URLinfo
- CVE-2026-94265: curl Negotiate authentication credential exposure on redirectinfo
- CVE-2026-92391: curl stack overflow in MIME structure cleanupinfo
- CVE-2026-92390: curl remote-header-name file overwrite bypassinfo
- CVE-2026-92387: curl infinite loop via server response omissioninfo
- CVE-2026-92386: curl server-set cookie aborts cookie jar loadinfo
- CVE-2026-87866: curl wolfSSL public-key pinning bypassinfo
- CVE-2026-87865: curl libssh2 host key validation bypass with hashed known_hostsinfo
- CVE-2026-87864: curl IMAP APPEND plus CRLF conversion command injectioninfo
- CVE-2026-87863: curl HSTS cache data loss on serialization failureinfo
- CVE-2026-87862: curl HSTS cache import drops longer-lived childinfo
- CVE-2026-87861: curl cross-origin reuse of Negotiate connectioninfo
- CVE-2026-86414: curl credential leak to HTTP proxyinfo
- CVE-2026-107929: curl local interface connection reuse mixupinfo
- CVE-2026-107928: curl information leak uploading over WebSockets with GnuTLSinfo
- CVE-2026-86413: curl Negotiate authentication credential leakage on redirectsinfo
- CVE-2026-86412: curl cookie jar data loss via server-set oversized cookieinfo
- CVE-2026-86411: curl FTP connection reuse inherits client certificateinfo
- CVE-2026-86410: curl redirect to SFTP or SCP bypasses host verificationinfo
- CVE-2026-86409: curl stale SigV4 headers sent unintendedinfo
- CVE-2026-92392: curl HTTP/2 upload use-after-freehighCVSS 8.1EPSS 0.6%
Most severe Curl vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-92392: curl HTTP/2 upload use-after-freehighCVSS 8.1EPSS 0.6%
- CVE-2026-94266: libcurl credentials leak in CURLINFO_EFFECTIVE_URLinfo
- CVE-2026-94265: curl Negotiate authentication credential exposure on redirectinfo
- CVE-2026-92391: curl stack overflow in MIME structure cleanupinfo
- CVE-2026-92390: curl remote-header-name file overwrite bypassinfo
- CVE-2026-92387: curl infinite loop via server response omissioninfo
- CVE-2026-92386: curl server-set cookie aborts cookie jar loadinfo
- CVE-2026-87866: curl wolfSSL public-key pinning bypassinfo
- CVE-2026-87865: curl libssh2 host key validation bypass with hashed known_hostsinfo
- CVE-2026-87864: curl IMAP APPEND plus CRLF conversion command injectioninfo
Vulnerabilities per week
21 vulnerabilities in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 1 | 0 | |
| 19 Oct 2026 | 20 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Curl vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/curl-curl)<a href="https://junglewise.ai/threats/technologies/curl-curl"><img src="https://junglewise.ai/threats/technologies/curl-curl/badge.svg" alt="Curl vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/curl-curl.json, and this page as text at https://junglewise.ai/threats/technologies/curl-curl.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Curl vulnerabilities", https://junglewise.ai/threats/technologies/curl-curl, 9 November 2026.