curl curl

• CVE-2026-10536 Critical 9.8 HTTP/2 stream-dependency tree UAF 0.6%
• CVE-2026-7168 Medium 5.3 cross-proxy Digest auth state leak 0.5%
• CVE-2026-7009 Medium 5.3 OCSP stapling bypass with Apple SecTrust 0.3%
• CVE-2026-6429 Medium 5.3 netrc credential leak with reused proxy connection 0.5%
• CVE-2026-6276 High 7.5 stale custom cookie host causes cookie leak 0.3%
• CVE-2026-6253 Medium 5.9 proxy credentials leak over redirect-to proxy 0.7%
• CVE-2026-5773 High 7.5 wrong reuse of SMB connection 0.6%
• CVE-2026-5545 Medium 6.5 wrong reuse of HTTP Negotiate connection 0.4%
• CVE-2026-4873 Medium 5.9 connection reuse ignores TLS requirement 0.3%
• CVE-2026-3805 High 7.5 use after free in SMB connection reuse 0.9%
• CVE-2026-3784 Medium 6.5 wrong proxy connection reuse with credentials 0.4%
• CVE-2026-3783 Medium 5.3 token leak with redirect and netrc 0.5%
• CVE-2026-1965 Medium 6.5 bad reuse of HTTP Negotiate connection 0.3%
• CVE-2025-11563 Medium 4.6 wcurl path traversal with percent-encoded slashes 0.4%
• CVE-2025-15224 Low 3.1 libssh key passphrase bypass without agent set 0.5%
• CVE-2025-15079 Medium 5.3 libssh global known_hosts override 0.5%
• CVE-2025-14819 Medium 5.3 OpenSSL partial chain store policy bypass 0.8%
• CVE-2025-14524 Medium 5.3 bearer token leak on cross-protocol redirect 0.7%
• CVE-2025-14017 Medium 6.3 broken TLS options for threaded LDAPS 0.1%
• CVE-2025-13034 Medium 5.9 No QUIC certificate pinning with GnuTLS 0.2%
• CVE-2025-10966 Medium 4.3 missing SFTP host verification with wolfSSH 0.4%
• CVE-2025-10148 Medium 5.3 predictable WebSocket mask 0.5%
• CVE-2025-9086 High 7.5 Out of bounds read for cookie path 1.5%
• CVE-2025-5399 High 7.5 WebSocket endless loop 1.4%
• CVE-2025-5025 Medium 4.8 No QUIC certificate pinning with wolfSSL 0.3%
• CVE-2025-4947 Medium 6.5 QUIC certificate check skip with wolfSSL 0.3%
• CVE-2025-0725 High 7.3 gzip integer overflow 1.8%
• CVE-2025-0665 High 7.0 eventfd double close 1.3%
• CVE-2025-0167 Low 3.4 netrc and default credential leak 0.7%
• CVE-2024-11053 Low 3.4 netrc and redirect credential leak 2.0%
• CVE-2024-9681 Medium 5.9 HSTS subdomain overwrites parent cache entry 2.0%
• CVE-2024-8096 Medium 6.5 OCSP stapling bypass with GnuTLS 0.8%
• CVE-2024-7264 Medium 6.3 ASN.1 date parser overread 20.2%
• CVE-2024-6874 Low 3.1 macidn punycode buffer overread 0.8%
• CVE-2024-6197 High 7.5 freeing stack buffer in utf8asn1str 4.3%
• CVE-2024-2466 Medium 6.5 TLS certificate check bypass with mbedTLS 1.5%
• CVE-2024-2379 Medium 6.3 QUIC certificate check bypass with wolfSSL 1.9%
• CVE-2024-2398 High 8.6 HTTP/2 push headers memory-leak 36.1%
• CVE-2024-2004 Low 3.5 Usage of disabled protocol 1.7%
• CVE-2024-0853 Medium 5.3 OCSP verification bypass with TLS session reuse 1.1%
• CVE-2023-46219 Medium 5.3 When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. 1.1%
• CVE-2023-46218 Medium 6.5 This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that the 1.7%
• CVE-2023-38545 High 8.8 This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it 78.7%
• CVE-2023-38546 Unrated This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creat 6.0%
• CVE-2023-38039 High 7.5 When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large header 56.2%