Version prüfen
curl --versionCVEs, die 7.85 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2026-19931 | Negotiate ambient user conn reuse | 9.8 | — | 2026-09-06 | |
| CVE-2022-32221 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask... | 9.8 | — | 2022-12-05 | |
| CVE-2026-11856 | cross-origin Digest auth state leak | 9.8 | — | 2026-07-03 | |
| CVE-2023-23914 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS... | 9.1 | — | 2023-02-23 | |
| CVE-2026-18924 | HTTP/2 server push UAF | 9.1 | — | 2026-09-06 | |
| CVE-2026-8927 | env-set cross-proxy Digest auth state leak | 9.1 | — | 2026-07-03 | |
| CVE-2026-8924 | trailing dot domain super cookie | 9.1 | — | 2026-07-03 | |
| CVE-2023-27533 | A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may all... | 8.8 | — | 2023-03-30 | |
| CVE-2023-27534 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be... | 8.8 | — | 2023-03-30 | |
| CVE-2024-2398 | HTTP/2 push headers memory-leak | 8.6 | — | 2024-03-27 | |
| CVE-2026-82209 | domain-scoped PSL domain cookie | 8.2 | — | 2026-09-06 | |
| CVE-2022-42915 | curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) U... | 8.1 | — | 2022-10-29 | |
| CVE-2026-8286 | wrong STARTTLS connection reuse | 8.1 | — | 2026-07-03 | |
| CVE-2026-12064 | proto-default skips SSH verification | 7.5 | — | 2026-07-03 | |
| CVE-2026-6276 | stale custom cookie host causes cookie leak | 7.5 | — | 2026-05-13 | |
| CVE-2026-80230 | OpenSSL pinning bypass | 7.5 | — | 2026-09-06 | |
| CVE-2023-38039 | When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via th... | 7.5 | — | 2023-09-15 | |
| CVE-2026-5773 | wrong reuse of SMB connection | 7.5 | — | 2026-05-13 | |
| CVE-2026-8932 | incomplete mTLS config matching in conn reuse | 7.5 | — | 2026-07-03 | |
| CVE-2022-42916 | In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS sup... | 7.5 | — | 2022-10-29 | |
| CVE-2023-28319 | A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH ser... | 7.5 | — | 2023-05-26 | |
| CVE-2026-80231 | native CA store conn reuse | 7.5 | — | 2026-09-06 | |
| CVE-2022-43551 | A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using... | 7.5 | — | 2022-12-23 | |
| CVE-2026-9547 | SSH improper host validation | 7.4 | — | 2026-07-03 | |
| CVE-2026-13608 | OpenLDAP SASL authentication bypass | 7.4 | — | 2026-09-06 | |
| CVE-2025-0725 | gzip integer overflow | 7.3 | — | 2025-02-05 | |
| CVE-2026-3784 | wrong proxy connection reuse with credentials | 6.5 | — | 2026-03-11 | |
| CVE-2024-9681 | HSTS subdomain overwrites parent cache entry | 6.5 | — | 2024-11-06 | |
| CVE-2026-5545 | wrong reuse of HTTP Negotiate connection | 6.5 | — | 2026-05-13 | |
| CVE-2026-1965 | bad reuse of HTTP Negotiate connection | 6.5 | — | 2026-03-11 | |
| CVE-2024-8096 | OCSP stapling bypass with GnuTLS | 6.5 | — | 2024-09-11 | |
| CVE-2023-23915 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS... | 6.5 | — | 2023-02-23 | |
| CVE-2022-35260 | curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive no... | 6.5 | — | 2022-12-05 | |
| CVE-2026-8458 | wrong reuse for different services | 6.5 | — | 2026-07-03 | |
| CVE-2023-46218 | This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more orig... | 6.5 | — | 2023-12-07 | |
| CVE-2023-23916 | An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "ch... | 6.5 | — | 2023-02-23 | |
| CVE-2025-14017 | broken TLS options for threaded LDAPS | 6.3 | — | 2026-01-08 | |
| CVE-2023-28321 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wil... | 5.9 | — | 2023-05-26 | |
| CVE-2022-43552 | A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols i... | 5.9 | — | 2023-02-09 | |
| CVE-2026-4873 | connection reuse ignores TLS requirement | 5.9 | — | 2026-05-13 | |
| CVE-2026-6253 | proxy credentials leak over redirect-to proxy | 5.9 | — | 2026-05-13 | |
| CVE-2023-28320 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backend... | 5.9 | — | 2023-05-26 | |
| CVE-2025-15079 | libssh global known_hosts override | 5.3 | — | 2026-01-08 | |
| CVE-2023-46219 | When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subseq... | 5.3 | — | 2023-12-12 | |
| CVE-2026-6429 | netrc credential leak with reused proxy connection | 5.3 | — | 2026-05-13 | |
| CVE-2026-7168 | cross-proxy Digest auth state leak | 5.3 | — | 2026-05-13 | |
| CVE-2025-14524 | bearer token leak on cross-protocol redirect | 5.3 | — | 2026-01-08 | |
| CVE-2026-3783 | token leak with redirect and netrc | 5.3 | — | 2026-03-11 | |
| CVE-2025-10966 | missing SFTP host verification with wolfSSH | 4.3 | — | 2025-11-07 | |
| CVE-2023-28322 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might err... | 3.7 | — | 2023-05-26 | |
| CVE-2024-2004 | Usage of disabled protocol | 3.5 | — | 2024-03-27 | |
| CVE-2024-11053 | netrc and redirect credential leak | 3.4 | — | 2024-12-11 | |
| CVE-2025-0167 | netrc and default credential leak | 3.4 | — | 2025-02-05 | |
| CVE-2025-15224 | libssh key passphrase bypass without agent set | 3.1 | — | 2026-01-08 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).