Loading story…
The curl project released curl/libcurl 8.20.0 with fixes for several disclosed vulnerabilities that could leak credentials, cookies, or authenticated session state across requests, redirects, proxies, and reused connections. The most broadly exposed issue, CVE-2026-6253, allows proxy credentials to be forwarded to a different proxy during cross-scheme redirects when separate proxies are configured; it affects curl and libcurl from 7.14.1 through 8.19.0. curl also fixed CVE-2026-5545, where HTTP(S) connections authenticated with Negotiate could be wrongly reused for a different user, potentially sending requests over a connection still authenticated as the first user; that flaw affects versions 7.10.6 through 8.19.0 and also impacts the command-line tool.
Additional flaws primarily affect libcurl handle and connection reuse. CVE-2026-7168 can leak Digest proxy authentication state when the same handle is reused across different HTTP proxies, CVE-2026-6429 can expose .netrc credentials during HTTP redirects over a reused proxied connection, and CVE-2026-6276 can send cookies for one host to another after reuse of an easy handle with a removed custom Host: header. The affected ranges span from 7.12.0 to 8.19.0 depending on the bug, and curl advised users to upgrade to 8.20.0, apply the published patches, or avoid risky patterns such as proxy credential use, custom Host: headers, .netrc with proxied cleartext HTTP, HTTP Negotiate, and handle reuse when switching proxies.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
On April 29, 2026, curl publicly disclosed CVE-2026-5545, CVE-2026-6253, CVE-2026-6276, CVE-2026-6429, and CVE-2026-7168. The project said these issues were fixed in curl/libcurl 8.20.0 and advised users to upgrade or apply patches.
A GitHub commit dated April 27, 2026 added changes and a test around clearing proxy authentication properties when switching proxies. The commit aligns with the later disclosure of CVE-2026-7168.
curl said CVE-2026-7168 was reported on April 27, 2026. The bug concerned leakage of Digest proxy authentication state when reusing a libcurl handle across different proxies.
curl stated that CVE-2026-5545 was coordinated with distros@openwall on April 23, 2026 ahead of public disclosure. This reflects the project's pre-release vulnerability coordination process.
A GitHub commit dated April 14, 2026 introduced helper functions to reset user and proxy credentials before transfers. The change modified how libcurl restores configured credentials into transfer state.
curl said the vulnerability later assigned CVE-2026-5545 was reported on April 1, 2026. The flaw involved incorrect reuse of Negotiate-authenticated HTTP(S) connections across different credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
11 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcecurl.se
Open sourcecurl.se
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The curl project released **curl/libcurl 8.22.0**, its 276th release, with 302 bug fixes and ten security advisories: nine affecting curl or libcurl and one affecting `wcurl`. The fixes address authentication bypasses, use-after-free conditions, certificate-validation and certificate-pinning bypasses, unsafe connection reuse, and cookie-policy bypasses. The release also adds experimental RFC 9421 HTTP Message Signatures support, prevents NTLM fallback during SPNEGO negotiation, adds Apple-platform support, and removes TLS-SRP support. One advisory, **CVE-2026-80256**, is a medium-severity Windows path-traversal flaw in `wcurl`. Percent-encoded backslashes in a server-influenced output filename can be decoded, allowing a file to be written outside the directory selected by the user. Affected versions include `wcurl` bundled with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05; remediation is to upgrade to curl 8.22.0 or wcurl 2026.08.30, apply the patch, explicitly set output filenames, or disable output-filename percent decoding.
Sep 4, 2026
curl 8.21.0 fixes multiple security and correctness issues caused by trailing-dot hostname handling, including **CVE-2026-8924**, a cookie parsing flaw that lets a malicious HTTP server set "super cookies" for public suffix domains. By abusing hostnames such as `example.co.uk.`, an attacker could bypass curl's Public Suffix List validation and cause curl to later send attacker-set cookies to unrelated third-party domains. The vulnerability affects curl versions `7.46.0` through `8.20.0`; builds without PSL support are not protected against this class of issue, and the project recommends upgrading to `8.21.0`, applying the patch, or avoiding trailing dots in hostnames. The release also addresses two additional trailing-dot bugs: curl could treat an IPv4 literal with a trailing dot as a hostname rather than an IP address, potentially allowing an incorrect wildcard TLS certificate match, and hostnames with double trailing dots could trigger internal logic errors including HSTS confusion. curl now bans double-trailing-dot names, and the fixes were coordinated through a June disclosure process after the cookie issue was reported by vegagent on HackerOne and patched by Daniel Stenberg.
Jul 12, 2026
Libssh released versions **0.12.1** and **0.11.5** to fix multiple security issues, including **CVE-2026-59851**, an authentication bypass in deployments where `GSSAPIKeyExchange` is enabled on servers. The flaw allows an authenticated client to log in as an arbitrary local user because the `gssapi-keyex` path fails to verify whether the authenticated Kerberos principal is authorized for the requested account. The vulnerability is tracked as **CWE-863** and carries a **CVSS v3.1** score reflecting high impact to confidentiality, integrity, and availability. The **0.12.1** release addresses **11 CVEs**, while **0.11.5** backports fixes for **8 CVEs** affecting the 0.11 branch. In addition to the authentication bypass, the updates remediate a stack buffer overflow, information disclosure bugs, several denial-of-service conditions, a use-after-free issue, and an integrity downgrade flaw, alongside hardening changes such as zero-initializing `ssh_string` objects and validating peer public keys during Diffie-Hellman key exchange. Red Hat reported **RHEL 8** and **RHEL 9** as unaffected by `CVE-2026-59851`, listed **RHEL 10** status as unknown, and marked **Red Hat Hardened Images** as affected for `libssh` and `libssh2` package entries.
Jul 21, 2026