Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: curl 8.16.1, 8.20.1 Clear all filters
TI-2026-07845 CVE-2026-8925 · GHSA-p8x5-c6c9-8cwx

SASL double-free

Priority HIGH 82

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0108 Published 2026-07-03 Fixed in 8.16.1, 8.20.1 CWE-415
TI-2026-10006 CVE-2026-11586 · GHSA-c68q-h477-5646

WS Auto-PONG memory exhaustion

Priority MEDIUM 40

By default, curl automatically responds to WebSocket PING frames.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0086 Published 2026-07-03 Partial fix · 8.16.1, 8.20.1 CWE-770