Vendor
Curl vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 66 vulnerabilities in Curl: 0 in the last 7 days and 33 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-94266, was published on 20 October 2026. 24 vulnerabilities in the last four weeks, up from none in the four before. 2 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 33
- Critical, all time
- 3
- Exploited in the wild
- 0
About Curl
Command-line tool and library for transferring data over URLs.
Curl technologies
Latest Curl vulnerabilities
- CVE-2026-94266: libcurl credentials leak in CURLINFO_EFFECTIVE_URLinfo
- CVE-2026-94265: curl Negotiate authentication credential exposure on redirectinfo
- CVE-2026-92391: curl stack overflow in MIME structure cleanupinfo
- CVE-2026-92390: curl remote-header-name file overwrite bypassinfo
- CVE-2026-92389: libcurl TFTP direction confusioninfo
- CVE-2026-92388: curl FTP wildcard write callback mixupinfo
- CVE-2026-92387: curl infinite loop via server response omissioninfo
- CVE-2026-92386: curl server-set cookie aborts cookie jar loadinfo
- CVE-2026-87866: curl wolfSSL public-key pinning bypassinfo
- CVE-2026-87865: curl libssh2 host key validation bypass with hashed known_hostsinfo
- CVE-2026-87864: curl IMAP APPEND plus CRLF conversion command injectioninfo
- CVE-2026-87863: curl HSTS cache data loss on serialization failureinfo
- CVE-2026-87862: curl HSTS cache import drops longer-lived childinfo
- CVE-2026-87861: curl cross-origin reuse of Negotiate connectioninfo
- CVE-2026-86415: curl auto client cert connection reuse mixupinfo
- CVE-2026-86414: curl credential leak to HTTP proxyinfo
- CVE-2026-107929: curl local interface connection reuse mixupinfo
- CVE-2026-107928: curl information leak uploading over WebSockets with GnuTLSinfo
- CVE-2026-86413: curl Negotiate authentication credential leakage on redirectsinfo
- CVE-2026-86412: curl cookie jar data loss via server-set oversized cookieinfo
- CVE-2026-86411: curl FTP connection reuse inherits client certificateinfo
- CVE-2026-86410: curl redirect to SFTP or SCP bypasses host verificationinfo
- CVE-2026-86409: curl stale SigV4 headers sent unintendedinfo
- CVE-2026-92392: curl HTTP/2 upload use-after-freehighCVSS 8.1EPSS 0.6%
- CVE-2026-82209: curl Public Suffix List domain boundary check bypass in cookie handlinghighCVSS 8.2EPSS 0.5%
Most severe Curl vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-19931: curl Negotiate authentication connection reusecriticalCVSS 9.8EPSS 0.8%
- CVE-2023-38545: curl SOCKS5 heap buffer overflow during handshakecriticalCVSS 9.8
- CVE-2026-18924: curl libcurl HTTP/2 server push use-after-freecriticalCVSS 9.1EPSS 0.6%
- CVE-2026-82209: curl Public Suffix List domain boundary check bypass in cookie handlinghighCVSS 8.2EPSS 0.5%
- CVE-2026-92392: curl HTTP/2 upload use-after-freehighCVSS 8.1EPSS 0.6%
- CVE-2026-80231: curl HTTPS connection reuse with mismatched CA store settingshighCVSS 7.5EPSS 0.9%
- CVE-2026-80229: curl OpenSSL provider use-after-free in TLS connectionshighCVSS 7.5EPSS 0.9%
- CVE-2026-80255: curl secure cookie attribute bypass with tabhighCVSS 7.5EPSS 0.7%
- CVE-2026-80230: curl public key pinning bypass with disabled peer verificationhighCVSS 7.5EPSS 0.5%
- CVE-2026-82208: curl libcurl certificate validation bypass in wolfSSL backendhighCVSS 7.5EPSS 0.4%
Vulnerabilities per week
24 vulnerabilities in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 9 | 2 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 1 | 0 | |
| 19 Oct 2026 | 23 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Curl vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/curl)<a href="https://junglewise.ai/threats/vendors/curl"><img src="https://junglewise.ai/threats/vendors/curl/badge.svg" alt="Curl vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/curl.json, and this page as text at https://junglewise.ai/threats/vendors/curl.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Curl vulnerabilities", https://junglewise.ai/threats/vendors/curl, 9 November 2026.