# Curl vulnerabilities Source: https://junglewise.ai/threats/vendors/curl Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/curl.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 66 vulnerabilities in Curl: 0 in the last 7 days and 33 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-94266, was published on 20 October 2026. 24 vulnerabilities in the last four weeks, up from none in the four before. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 24 - Last 90 days: 33 - All time: 66 (3 critical, 0 exploited in the wild) ## About Curl Command-line tool and library for transferring data over URLs. ## Latest Curl vulnerabilities - [CVE-2026-94266: libcurl credentials leak in CURLINFO_EFFECTIVE_URL](https://junglewise.ai/threats/cve-2026-94266-libcurl-could-accidentally-return-a-url-for-curl-easy-getinfo-s) (info, published 20 Oct 2026) - [CVE-2026-94265: curl Negotiate authentication credential exposure on redirect](https://junglewise.ai/threats/cve-2026-94265-when-processing-an-http-redirect-to-a-url-containing-userinfo-a) (info, published 20 Oct 2026) - [CVE-2026-92391: curl stack overflow in MIME structure cleanup](https://junglewise.ai/threats/cve-2026-92391-a-deeply-nested-multipart-mime-structure-constructed-via-the) (info, published 20 Oct 2026) - [CVE-2026-92390: curl remote-header-name file overwrite bypass](https://junglewise.ai/threats/cve-2026-92390-when-invoked-with-remote-header-name-j-curl-fails-to-preserve-its) (info, published 20 Oct 2026) - [CVE-2026-92389: libcurl TFTP direction confusion](https://junglewise.ai/threats/cve-2026-92389-libcurl-s-tftp-state-machine-fails-to-validate-state-transitions) (info, published 20 Oct 2026) - [CVE-2026-92388: curl FTP wildcard write callback mixup](https://junglewise.ai/threats/cve-2026-92388-when-an-ftp-wildcard-list-operation-fails-libcurl-omits-the) (info, published 20 Oct 2026) - [CVE-2026-92387: curl infinite loop via server response omission](https://junglewise.ai/threats/cve-2026-92387-by-permanently-omitting-the-final-control-response-line-a) (info, published 20 Oct 2026) - [CVE-2026-92386: curl server-set cookie aborts cookie jar load](https://junglewise.ai/threats/cve-2026-92386-when-writing-a-long-cookie-name-and-value-to-a-netscape-cookie) (info, published 20 Oct 2026) - [CVE-2026-87866: curl wolfSSL public-key pinning bypass](https://junglewise.ai/threats/cve-2026-87866-when-built-with-wolfssl-curl-can-successfully-validate-a-pinned) (info, published 20 Oct 2026) - [CVE-2026-87865: curl libssh2 host key validation bypass with hashed known_hosts](https://junglewise.ai/threats/cve-2026-87865-when-libcurl-uses-libssh2-with-a-hashed-known-hosts-file-an) (info, published 20 Oct 2026) - [CVE-2026-87864: curl IMAP APPEND plus CRLF conversion command injection](https://junglewise.ai/threats/cve-2026-87864-enabling-curlopt-crlf-causes-curl-to-advertise-the-raw-input-byte) (info, published 20 Oct 2026) - [CVE-2026-87863: curl HSTS cache data loss on serialization failure](https://junglewise.ai/threats/cve-2026-87863-an-authenticated-https-origin-can-supply-an-hsts-max-age-value) (info, published 20 Oct 2026) - [CVE-2026-87862: curl HSTS cache import drops longer-lived child](https://junglewise.ai/threats/cve-2026-87862-importing-a-includesubdomains-parent-hsts-entry-before-a-longer) (info, published 20 Oct 2026) - [CVE-2026-87861: curl cross-origin reuse of Negotiate connection](https://junglewise.ai/threats/cve-2026-87861-when-using-ambient-user-credentials-an-http-request-directed-to) (info, published 20 Oct 2026) - [CVE-2026-86415: curl auto client cert connection reuse mixup](https://junglewise.ai/threats/cve-2026-86415-libcurl-s-connection-cache-match-function-never-considers-the) (info, published 20 Oct 2026) - [CVE-2026-86414: curl credential leak to HTTP proxy](https://junglewise.ai/threats/cve-2026-86414-an-http-proxy-can-trick-libcurl-into-sending-the-origin-s) (info, published 20 Oct 2026) - [CVE-2026-107929: curl local interface connection reuse mixup](https://junglewise.ai/threats/cve-2026-107929-when-curlopt-interface-or-the-command-line-tool-s-interface) (info, published 20 Oct 2026) - [CVE-2026-107928: curl information leak uploading over WebSockets with GnuTLS](https://junglewise.ai/threats/cve-2026-107928-when-curl-is-built-with-gnutls-a-malicious-websocket-server-can) (info, published 20 Oct 2026) - [CVE-2026-86413: curl Negotiate authentication credential leakage on redirects](https://junglewise.ai/threats/cve-2026-86413-when-using-an-ambient-user-in-a-first-transfer-doing-negotiate) (info, published 20 Oct 2026) - [CVE-2026-86412: curl cookie jar data loss via server-set oversized cookie](https://junglewise.ai/threats/cve-2026-86412-a-remote-http-server-can-set-a-cookie-that-curl-accepts-and) (info, published 20 Oct 2026) - [CVE-2026-86411: curl FTP connection reuse inherits client certificate](https://junglewise.ai/threats/cve-2026-86411-an-ftp-transfer-configured-with-curlusessl-none-can-reuse-a) (info, published 20 Oct 2026) - [CVE-2026-86410: curl redirect to SFTP or SCP bypasses host verification](https://junglewise.ai/threats/cve-2026-86410-a-flaw-in-the-curl-command-line-tool-s-logic-makes-it-only-set) (info, published 20 Oct 2026) - [CVE-2026-86409: curl stale SigV4 headers sent unintended](https://junglewise.ai/threats/cve-2026-86409-setting-curlopt-aws-sigv4-to-null-but-does-not-disable-sigv4) (info, published 20 Oct 2026) - [CVE-2026-92392: curl HTTP/2 upload use-after-free](https://junglewise.ai/threats/cve-2026-92392-during-an-upload-curl-mishandles-http-2-rst-stream-received-from) (high, CVSS 8.1, published 14 Oct 2026) - [CVE-2026-82209: curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie) (high, CVSS 8.2, published 6 Sep 2026) ## Most severe Curl vulnerabilities - [CVE-2026-19931: curl Negotiate authentication connection reuse](https://junglewise.ai/threats/cve-2026-19931-curl-negotiate-authentication-connection-reuse) (critical, CVSS 9.8, published 6 Sep 2026) - [CVE-2023-38545: curl SOCKS5 heap buffer overflow during handshake](https://junglewise.ai/threats/cve-2023-38545-curl-socks5-heap-buffer-overflow-during-handshake) (critical, CVSS 9.8, published 18 Oct 2023) - [CVE-2026-18924: curl libcurl HTTP/2 server push use-after-free](https://junglewise.ai/threats/cve-2026-18924-curl-libcurl-http-2-server-push-use-after-free) (critical, CVSS 9.1, published 6 Sep 2026) - [CVE-2026-82209: curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie) (high, CVSS 8.2, published 6 Sep 2026) - [CVE-2026-92392: curl HTTP/2 upload use-after-free](https://junglewise.ai/threats/cve-2026-92392-during-an-upload-curl-mishandles-http-2-rst-stream-received-from) (high, CVSS 8.1, published 14 Oct 2026) - [CVE-2026-80231: curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings) (high, CVSS 7.5, published 6 Sep 2026) - [CVE-2026-80229: curl OpenSSL provider use-after-free in TLS connections](https://junglewise.ai/threats/cve-2026-80229-curl-openssl-provider-use-after-free-in-tls-connections) (high, CVSS 7.5, published 6 Sep 2026) - [CVE-2026-80255: curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab) (high, CVSS 7.5, published 6 Sep 2026) - [CVE-2026-80230: curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification) (high, CVSS 7.5, published 6 Sep 2026) - [CVE-2026-82208: curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend) (high, CVSS 7.5, published 6 Sep 2026) ## Vulnerabilities per week 24 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 9 | 2 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 23 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Curl technologies - [Curl](https://junglewise.ai/threats/technologies/curl-curl): 21 vulnerabilities - [Curl Libcurl](https://junglewise.ai/threats/technologies/curl-libcurl): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Curl vulnerabilities", https://junglewise.ai/threats/vendors/curl, 9 November 2026.