Curl -- Multiple vulnerabilities

2026-10-14 · CVE-2026-107929, CVE-2026-107928, CVE-2026-94266, CVE-2026-94265, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-92391, CVE-2026-92392, CVE-2026-86410, CVE-2026-86412, CVE-2026-86413, CVE-2026-86414, CVE-2026-86415, CVE-2026-87861, CVE-2026-87862, CVE-2026-87863, CVE-2026-87865, CVE-2026-87866 · VuXML entry

The Curl project reports: local interface connection reuse mixup (CVE-2026-107929) info leak uploading over WebSockets with GnuTLS (CVE-2026-107928) password leak in CURLINFO_EFFECTIVE_URL (CVE-2026-94266) Authorization: Negotiate sent to foreign origin (CVE-2026-94265) server-set cookie aborts cookie jar load (CVE-2026-92386) never-ending loop via server response omission (CVE-2026-92387) FTP wildcard write …

Affected versions

• curl < 8.23.0

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.