Curl
Vendor:
First CVE: Oct 13, 2005 · Active for 20 years
67
Total CVEs
More Total CVEs than 98% of tracked products
7.4
Avg CVEs / Year
Higher CVE frequency than 94% of tracked products
6.7
Avg CVSS
Higher Avg CVSS than 34% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Curl over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 13, 2005
20 years ago
Most Recent CVE
Jul 3, 2026
21 days ago
CVE Severity & Scoring
Curl67 CVEs
46%
33%
13%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local1 (1.5%)
Network61 (91.0%)
Unknown5 (7.5%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low46 (68.7%)
High16 (23.9%)
Unknown5 (7.5%)
User Interaction
None51 (76.1%)
Unknown5 (7.5%)
Required11 (16.4%)
Privileges Required
Low8 (11.9%)
High0 (0.0%)
None54 (80.6%)
Unknown5 (7.5%)
Top CVEs
Signals from CVEs in this product scope (67 CVEs).
67 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-38545CRITICAL This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
handshake.
When curl is asked to pass along the host name to the SOCKS5 proxy to allow
that to resolve the ad | Oct 18, 2023 | 9.8 | 76 | NO | NO |
CVE-2023-38039HIGH When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API.
However, curl did not have a limit in how many | Sep 15, 2023 | 7.5 | 59 | NO | NO |
CVE-2024-2398HIGH When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts t | Mar 27, 2024 | 8.6 | 46 | NO | NO |
CVE-2026-9079CRITICAL libcurl had a flaw that when instructed to clear proxy authentication
credentials which made it not do so, leaving the old credentials around to get
used for subsequent transfers t | Jul 3, 2026 | 9.8 | 43 | NO | NO |
CVE-2026-8925CRITICAL The curl logic that works with SASL authentication could end up cleaning up
the GSASL context *twice* without clearing the pointer in between, making it
`free()` the same pointer t | Jul 3, 2026 | 9.8 | 42 | NO | NO |
CVE-2026-10536CRITICAL A use-after-free vulnerability exists in libcurl when an application
configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or
`CURLOPT_STREAM_DEPENDS_E`, subsequ | Jul 3, 2026 | 9.8 | 42 | NO | NO |
CVE-2026-11856CRITICAL Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a secon | Jul 3, 2026 | 9.8 | 41 | NO | NO |
CVE-2026-8932HIGH libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.
libcurl keeps previously used con | Jul 3, 2026 | 7.5 | 39 | NO | NO |
CVE-2026-8927CRITICAL When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. S | Jul 3, 2026 | 9.1 | 39 | NO | NO |
CVE-2026-8924CRITICAL A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
'super cookies' that bypass the Public Suffix List check. This enables an
attacker-controlled origin to | Jul 3, 2026 | 9.1 | 39 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (67 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
1.5% of CVEs· 87th percentile
Social Chatter
Signals from CVEs in this product scope (67 CVEs).
Media Mentions
Signals from CVEs in this product scope (67 CVEs).
Top CNAs Publishing CVEs For Curl
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 7.9.8 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.9.7 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.9.6 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.9.5 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.9.4 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.9.3 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.9.2 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.9.1 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.9 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.8.2 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.8.1 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.8 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.7.3 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.7.2 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.7.1 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.7 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.6.1 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.6 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.5.2 | 1 | 6.8 | 7.8% | 0 | 1 |
| 7.5.1 | 1 | 6.8 | 7.8% | 0 | 1 |