curl is a widely embedded HTTP client library and command-line tool whose compact product footprint—centered on curl, libcurl, and related utilities—masks substantial deployment breadth across servers, applications, and embedded systems. Its vulnerability profile recurs through network-parsing and data-handling weaknesses including path traversal, CSRF, SQL injection, and buffer-boundary issues, classes that reflect the library's role in processing untrusted network input and passing data to downstream code. Public exploit code has been associated with this vendor's disclosures; current severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by curl over time
Of all the CVEs published by curl as a CNA, 100.0% affect products that curl develops as a vendor.
Of all the CVEs published that affect products developed by curl, 83.8% are self-published by curl as a CNA.
Signals from CVEs in this vendor scope (69 CVEs).
69 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-38545CRITICAL This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
handshake.
When curl is asked to pass along the host name to the SOCKS5 proxy to allow
that to resolve the ad | Oct 18, 2023 | 9.8 | 76 | NO | NO |
CVE-2023-38039HIGH When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API.
However, curl did not have a limit in how many | Sep 15, 2023 | 7.5 | 59 | NO | NO |
CVE-2024-2398HIGH When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts t | Mar 27, 2024 | 8.6 | 46 | NO | NO |
CVE-2026-9079CRITICAL libcurl had a flaw that when instructed to clear proxy authentication
credentials which made it not do so, leaving the old credentials around to get
used for subsequent transfers t | Jul 3, 2026 | 9.8 | 43 | NO | NO |
CVE-2026-8925CRITICAL The curl logic that works with SASL authentication could end up cleaning up
the GSASL context *twice* without clearing the pointer in between, making it
`free()` the same pointer t | Jul 3, 2026 | 9.8 | 42 | NO | NO |
CVE-2026-10536CRITICAL A use-after-free vulnerability exists in libcurl when an application
configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or
`CURLOPT_STREAM_DEPENDS_E`, subsequ | Jul 3, 2026 | 9.8 | 42 | NO | NO |
CVE-2026-11856CRITICAL Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a secon | Jul 3, 2026 | 9.8 | 41 | NO | NO |
CVE-2026-8932HIGH libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.
libcurl keeps previously used con | Jul 3, 2026 | 7.5 | 39 | NO | NO |
CVE-2026-8927CRITICAL When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. S | Jul 3, 2026 | 9.1 | 39 | NO | NO |
CVE-2026-8924CRITICAL A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
'super cookies' that bypass the Public Suffix List check. This enables an
attacker-controlled origin to | Jul 3, 2026 | 9.1 | 39 | NO | NO |
Signals from CVEs in this vendor scope (69 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by curl.
Media articles that mention a CVE ID that affects a product developed by curl — matched by CVE ID, not by vendor name.