Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: curl 8.20.1 Clear all filters
TI-2026-08388 CVE-2026-9546 · GHSA-25rx-86v8-32c6

sending old referer

Priority HIGH 72

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00652 Published 2026-07-03 Partial fix · 8.20.1 CWE-200
TI-2026-09987 CVE-2026-11564 · GHSA-hf82-6jff-f22v

Native CA trust persist

Priority HIGH 74

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0061 Published 2026-07-03 Partial fix · 8.20.1 CWE-295
TI-2026-09799 CVE-2026-11352 · GHSA-qxwx-hr5v-h5q4

QUIC zero-length UDP datagrams busy-loop

Priority HIGH 72

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0101 Published 2026-07-03 Fixed in 8.20.1 CWE-835