Loading story…
The curl project released curl/libcurl 8.22.0, its 276th release, with 302 bug fixes and ten security advisories: nine affecting curl or libcurl and one affecting wcurl. The fixes address authentication bypasses, use-after-free conditions, certificate-validation and certificate-pinning bypasses, unsafe connection reuse, and cookie-policy bypasses. The release also adds experimental RFC 9421 HTTP Message Signatures support, prevents NTLM fallback during SPNEGO negotiation, adds Apple-platform support, and removes TLS-SRP support.
One advisory, CVE-2026-80256, is a medium-severity Windows path-traversal flaw in wcurl. Percent-encoded backslashes in a server-influenced output filename can be decoded, allowing a file to be written outside the directory selected by the user. Affected versions include wcurl bundled with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05; remediation is to upgrade to curl 8.22.0 or wcurl 2026.08.30, apply the patch, explicitly set output filenames, or disable output-filename percent decoding.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Tenable published Nessus plugin 342615 to identify libcurl 7.64.1 through versions before 8.22.0 affected by CVE-2026-19931, a Negotiate-authenticated connection-reuse information-disclosure flaw. The version-based check does not directly test exploitability and reports no known public exploits.
The curl project released curl and libcurl 8.22.0, its 276th release, with 302 bug fixes and nine security fixes. It published ten CVEs covering curl, libcurl, and wcurl, including authentication bypasses, use-after-free flaws, certificate-pinning or validation bypasses, connection-reuse issues, cookie-policy bypasses, and CVE-2026-80256.
The standalone wcurl 2026.08.30 release fixed CVE-2026-80256, the percent-encoded-backslash path traversal issue affecting Windows users.
Researcher 1rhino2 reported CVE-2026-80256 to the curl project through HackerOne. The Windows-only flaw lets percent-encoded backslashes in output filenames result in a new attacker-controlled file being created outside the user-selected directory, subject to the invoking user's permissions.
The curl project received Martin Dukek's vulnerability report for CVE-2026-19931, involving reuse of a Negotiate-authenticated HTTP connection across ambient user identities. Stefan Eissing subsequently patched the issue.
Tenable published a Unix-focused assessment plugin for unpatched critical curl vulnerability CVE-2026-13608 on listed Ubuntu LTS and Debian releases. The plugin describes network-reachable exploitation requiring no privileges or user interaction and states that no known public exploits are available.
Tenable's Unix-focused plugin 342437 identifies unpatched CVE-2026-19931 in curl packages on listed Ubuntu LTS and Debian releases. The plugin rates the issue critical under CVSS v3.0 and states that no known exploits are available.
Tenable published Nessus plugin 342617 to identify libcurl 7.44.0 through versions before 8.22.0 affected by CVE-2026-18924, an HTTP/2 Server Push use-after-free that can occur during cleanup when handles share connections. The version-based detection does not actively test exploitation, and no known exploits were reported.
Tenable identified CVE-2026-82208 as an unpatched critical (CVSS 9.8) curl-package vulnerability affecting multiple Ubuntu LTS releases and Debian 13.0 and 14.0. The notice describes network-reachable exploitation without privileges or user interaction and reports no known exploits.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
11 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceseclists.org
Open sourcetenable.com
Open sourcecurl.se
Open sourcecybersecurity-help.cz
Open sourcecurl.se
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The curl project released **curl/libcurl 8.20.0** with fixes for several disclosed vulnerabilities that could leak credentials, cookies, or authenticated session state across requests, redirects, proxies, and reused connections. The most broadly exposed issue, **`CVE-2026-6253`**, allows proxy credentials to be forwarded to a different proxy during cross-scheme redirects when separate proxies are configured; it affects **curl and libcurl** from `7.14.1` through `8.19.0`. curl also fixed **`CVE-2026-5545`**, where HTTP(S) connections authenticated with **Negotiate** could be wrongly reused for a different user, potentially sending requests over a connection still authenticated as the first user; that flaw affects versions `7.10.6` through `8.19.0` and also impacts the command-line tool. Additional flaws primarily affect **libcurl** handle and connection reuse. **`CVE-2026-7168`** can leak **Digest proxy authentication state** when the same handle is reused across different HTTP proxies, **`CVE-2026-6429`** can expose **`.netrc` credentials** during HTTP redirects over a reused proxied connection, and **`CVE-2026-6276`** can send cookies for one host to another after reuse of an easy handle with a removed custom `Host:` header. The affected ranges span from `7.12.0` to `8.19.0` depending on the bug, and curl advised users to **upgrade to 8.20.0**, apply the published patches, or avoid risky patterns such as proxy credential use, custom `Host:` headers, `.netrc` with proxied cleartext HTTP, HTTP Negotiate, and handle reuse when switching proxies.
Jun 29, 2026
curl 8.21.0 fixes multiple security and correctness issues caused by trailing-dot hostname handling, including **CVE-2026-8924**, a cookie parsing flaw that lets a malicious HTTP server set "super cookies" for public suffix domains. By abusing hostnames such as `example.co.uk.`, an attacker could bypass curl's Public Suffix List validation and cause curl to later send attacker-set cookies to unrelated third-party domains. The vulnerability affects curl versions `7.46.0` through `8.20.0`; builds without PSL support are not protected against this class of issue, and the project recommends upgrading to `8.21.0`, applying the patch, or avoiding trailing dots in hostnames. The release also addresses two additional trailing-dot bugs: curl could treat an IPv4 literal with a trailing dot as a hostname rather than an IP address, potentially allowing an incorrect wildcard TLS certificate match, and hostnames with double trailing dots could trigger internal logic errors including HSTS confusion. curl now bans double-trailing-dot names, and the fixes were coordinated through a June disclosure process after the cookie issue was reported by vegagent on HackerOne and patched by Daniel Stenberg.
Jul 12, 2026
Microsoft released fixes for **117 vulnerabilities** across 15 product families, including **3 Critical**, **110 Important**, **3 Moderate**, and **1 Low** severity issues. Two flaws were already being exploited in the wild: `CVE-2024-43572` in **Microsoft Management Console** and `CVE-2024-43573` in the **Windows MSHTML Platform**. Microsoft also flagged eight additional vulnerabilities as more likely to be exploited within 30 days, while Windows accounted for the vast majority of the exposure with **93 CVEs** spanning remote code execution, elevation of privilege, and denial-of-service bugs. The most severe issues included `CVE-2024-43468`, a **Critical Microsoft Configuration Manager remote code execution** flaw with a **CVSS 9.8** score that requires an in-console update and additional hardening, and `CVE-2024-38124`, a **Windows Netlogon elevation of privilege** vulnerability with mitigation guidance. The release also addressed 15 Windows Mobile Broadband Driver flaws that generally require physical access or proximity, Windows 11 24H2-specific bugs such as `CVE-2024-43527` and `CVE-2024-43571`, and advisory items affecting Edge and curl-related components; Sophos said protections were available for `CVE-2024-43502`, `CVE-2024-43572`, and `CVE-2024-43573`.
Jun 29, 2026