What the history shows
The software has 169 recorded CVEs with a maximum CVSS score of 9.8 and 0 known exploited vulnerabilities.
How to stay safe
Operators should ensure they stay on supported release lines and track installed software versions to maintain security.
Check your version
curl --versionAffected version lines
- 8.21 9 CVEs
- 8.20 26 CVEs
- 8.19 35 CVEs
- 8.18 38 CVEs
- 8.17 43 CVEs
- 8.16 42 CVEs
- 8.15 43 CVEs
- 8.14 43 CVEs
- 8.13 44 CVEs
- 8.12 39 CVEs
- 8.11 43 CVEs
- 8.10 40 CVEs
- 8.9 41 CVEs
- 8.8 40 CVEs
- 8.7 37 CVEs
- 8.6 41 CVEs
- 8.5 41 CVEs
- 8.4 40 CVEs
- 8.3 40 CVEs
- 8.1 41 CVEs
- 7.881 45 CVEs
- 7.88 47 CVEs
- 7.87 49 CVEs
- 7.86 50 CVEs
- 7.85 54 CVEs
- 7.84 54 CVEs
- 7.83 61 CVEs
- 7.82 64 CVEs
- 7.81 61 CVEs
- 7.80 60 CVEs
- 7.79 59 CVEs
- 7.78 61 CVEs
- 7.77 65 CVEs
- 7.76 63 CVEs
- 7.75 61 CVEs
- 7.74 60 CVEs
- 7.73 60 CVEs
- 7.71 60 CVEs
- 7.70 59 CVEs
- 7.69 59 CVEs
- 7.65 60 CVEs
- 7.64 59 CVEs
- 7.62 58 CVEs
- 7.61 59 CVEs
- 7.60 59 CVEs
- 7.59 61 CVEs
- 7.58 63 CVEs
- 7.57 62 CVEs
- 7.56 64 CVEs
- 7.55 64 CVEs
- 7.54 65 CVEs
- 7.53 64 CVEs
- 7.52 65 CVEs
- 7.51 67 CVEs
- 7.50 77 CVEs
- 7.49 79 CVEs
- 7.48 80 CVEs
- 7.47 80 CVEs
- 7.46 82 CVEs
- 7.45 78 CVEs
- 7.44 77 CVEs
- 7.43 75 CVEs
- 7.42 78 CVEs
- 7.41 82 CVEs
- 7.40 81 CVEs
- 7.39 78 CVEs
- 7.38 78 CVEs
- 7.37 79 CVEs
- 7.36 79 CVEs
- 7.35 81 CVEs
- 7.34 81 CVEs
- 7.33 81 CVEs
- 7.32 77 CVEs
- 7.31 77 CVEs
- 7.30 77 CVEs
- 7.29 75 CVEs
- 7.28 76 CVEs
- 7.27 76 CVEs
- 7.26 73 CVEs
- 7.25 72 CVEs
- 7.24 72 CVEs
- 7.23 73 CVEs
- 7.22 73 CVEs
- 7.21 73 CVEs
- 7.20 70 CVEs
- 7.19 65 CVEs
- 7.18 63 CVEs
- 7.17 61 CVEs
- 7.16 60 CVEs
- 7.15 59 CVEs
- 7.14 59 CVEs
- 7.13 56 CVEs
- 7.12 57 CVEs
- 7.11 53 CVEs
- 7.10 54 CVEs
- 7.9 44 CVEs
- 7.8 44 CVEs
- 7.7 44 CVEs
- 7.6 43 CVEs
- 7.5 39 CVEs
- 7.4 40 CVEs
- 7.3 39 CVEs
- 7.2 39 CVEs
- 7.1 39 CVEs
- 7.0 38 CVEs
- 6.5 36 CVEs
- 6.4 36 CVEs
- 6.3 36 CVEs
- 6.2 36 CVEs
- 6.1 36 CVEs
- 6.0 36 CVEs
- 4.9 36 CVEs
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-80229 | OpenSSL provider use-after-free | ≥ 8.14.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-80230 | OpenSSL pinning bypass | ≥ 7.45.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-80231 | native CA store conn reuse | ≥ 7.71.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-80255 | secure cookie attribute bypass with tab | ≥ 8.13.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-82208 | wolfSSL CA-cache hit overrides callback | ≥ 8.9.1 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-82209 | domain-scoped PSL domain cookie | ≥ 7.46.0 < 8.22.0 | 8.2 | — | 2026-09-06 | |
| CVE-2026-18924 | HTTP/2 server push UAF | ≥ 7.44.0 < 8.22.0 | 9.1 | — | 2026-09-06 | |
| CVE-2026-19931 | Negotiate ambient user conn reuse | ≥ 7.64.1 < 8.22.0 | 9.8 | — | 2026-09-06 | |
| CVE-2026-13608 | OpenLDAP SASL authentication bypass | ≥ 7.82.0 < 8.22.0 | 7.4 | — | 2026-09-06 | |
| CVE-2026-8926 | password leak with netrc and user in URL | ≥ 8.11.1 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-8927 | env-set cross-proxy Digest auth state leak | ≥ 7.12.0 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-8932 | incomplete mTLS config matching in conn reuse | ≥ 7.7 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-9079 | stale proxy password leak | ≥ 8.8.0 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-9080 | UAF after pause in socket callback | ≥ 8.13.0 < 8.21.0 | 7.3 | — | 2026-07-03 | |
| CVE-2026-9545 | exposing HTTP/3 early data | ≥ 8.11.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-9546 | sending old referer | ≥ 8.18.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-9547 | SSH improper host validation | ≥ 7.69.0 < 8.21.0 | 7.4 | — | 2026-07-03 | |
| CVE-2026-12064 | proto-default skips SSH verification | ≥ 7.81.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-8286 | wrong STARTTLS connection reuse | ≥ 7.30.0 < 8.21.0 | 8.1 | — | 2026-07-03 | |
| CVE-2026-8458 | wrong reuse for different services | ≥ 7.46.0 < 8.20.0 | 6.5 | — | 2026-07-03 | |
| CVE-2026-8924 | trailing dot domain super cookie | ≥ 7.46.0 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-8925 | SASL double-free | ≥ 8.15.0 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-10536 | HTTP/2 stream-dependency tree UAF | ≥ 7.88.0 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-11352 | QUIC zero-length UDP datagrams busy-loop | ≥ 8.18.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-11564 | Native CA trust persist | ≥ 8.17.0 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-11586 | WS Auto-PONG memory exhaustion | ≥ 8.16.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-11856 | cross-origin Digest auth state leak | ≥ 7.10.6 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-7009 | OCSP stapling bypass with Apple SecTrust | ≥ 8.17.0 < 8.20.0 | 5.3 | — | 2026-05-13 | |
| CVE-2026-7168 | cross-proxy Digest auth state leak | ≥ 7.12.0 < 8.20.0 | 5.3 | — | 2026-05-13 | |
| CVE-2026-5545 | wrong reuse of HTTP Negotiate connection | ≥ 7.10.6 < 8.20.0 | 6.5 | — | 2026-05-13 | |
| CVE-2026-5773 | wrong reuse of SMB connection | ≥ 7.40.0 < 8.20.0 | 7.5 | — | 2026-05-13 | |
| CVE-2026-6253 | proxy credentials leak over redirect-to proxy | ≥ 7.14.1 < 8.20.0 | 5.9 | — | 2026-05-13 | |
| CVE-2026-6276 | stale custom cookie host causes cookie leak | ≥ 7.71.0 < 8.20.0 | 7.5 | — | 2026-05-13 | |
| CVE-2026-6429 | netrc credential leak with reused proxy connection | ≥ 7.14.0 < 8.20.0 | 5.3 | — | 2026-05-13 | |
| CVE-2026-4873 | connection reuse ignores TLS requirement | ≥ 7.20.0 < 8.20.0 | 5.9 | — | 2026-05-13 | |
| CVE-2026-3783 | token leak with redirect and netrc | ≥ 7.33.0 < 8.19.0 | 5.3 | — | 2026-03-11 | |
| CVE-2026-3784 | wrong proxy connection reuse with credentials | ≥ 7.7 < 8.18.0 | 6.5 | — | 2026-03-11 | |
| CVE-2026-3805 | use after free in SMB connection reuse | ≥ 8.13.0 < 8.19.0 | 7.5 | — | 2026-03-11 | |
| CVE-2026-1965 | bad reuse of HTTP Negotiate connection | ≥ 7.10.6 < 8.19.0 | 6.5 | — | 2026-03-11 | |
| CVE-2025-15079 | libssh global known_hosts override | ≥ 7.58.0 < 8.18.0 | 5.3 | — | 2026-01-08 | |
| CVE-2025-15224 | libssh key passphrase bypass without agent set | ≥ 7.58.0 < 8.18.0 | 3.1 | — | 2026-01-08 | |
| CVE-2025-14524 | bearer token leak on cross-protocol redirect | ≥ 7.33.0 < 8.18.0 | 5.3 | — | 2026-01-08 | |
| CVE-2025-14819 | OpenSSL partial chain store policy bypass | ≥ 7.87.0 < 8.18.0 | 5.3 | — | 2026-01-08 | |
| CVE-2025-13034 | No QUIC certificate pinning with GnuTLS | ≥ 8.8.0 < 8.18.0 | 5.9 | — | 2026-01-08 | |
| CVE-2025-14017 | broken TLS options for threaded LDAPS | ≥ 7.17.0 < 8.18.0 | 6.3 | — | 2026-01-08 | |
| CVE-2025-10966 | missing SFTP host verification with wolfSSH | ≥ 7.69.0 < 8.17.0 | 4.3 | — | 2025-11-07 | |
| CVE-2025-9086 | Out of bounds read for cookie path | ≥ 8.13.0 < 8.16.0 | 7.5 | — | 2025-09-12 | |
| CVE-2025-10148 | predictable WebSocket mask | ≥ 8.11.0 < 8.16.0 | 5.3 | — | 2025-09-12 | |
| CVE-2025-5399 | WebSocket endless loop | ≥ 8.13.0 < 8.14.1 | 7.5 | — | 2025-06-07 | |
| CVE-2025-4947 | QUIC certificate check skip with wolfSSL | ≥ 8.8.0 < 8.14.0 | 6.5 | — | 2025-05-28 | |
| CVE-2025-5025 | No QUIC certificate pinning with wolfSSL | ≥ 8.5.0 < 8.14.0 | 4.8 | — | 2025-05-28 | |
| CVE-2025-0167 | netrc and default credential leak | ≥ 7.76.0 < 8.12.0 | 3.4 | — | 2025-02-05 | |
| CVE-2025-0665 | eventfd double close | = 8.11.1 | 7.0 | — | 2025-02-05 | |
| CVE-2025-0725 | gzip integer overflow | ≥ 7.10.5 < 8.12.0 | 7.3 | — | 2025-02-05 | |
| CVE-2024-11053 | netrc and redirect credential leak | ≥ 7.76.0 < 8.11.1 | 3.4 | — | 2024-12-11 | |
| CVE-2024-9681 | HSTS subdomain overwrites parent cache entry | ≥ 7.74.0 < 8.11.0 | 6.5 | — | 2024-11-06 | |
| CVE-2024-8096 | OCSP stapling bypass with GnuTLS | ≥ 7.41.0 < 8.10.0 | 6.5 | — | 2024-09-11 | |
| CVE-2024-2004 | Usage of disabled protocol | ≥ 7.85.0 < 8.7.0 | 3.5 | — | 2024-03-27 | |
| CVE-2024-2379 | QUIC certificate check bypass with wolfSSL | = 8.6.0 | 6.3 | — | 2024-03-27 | |
| CVE-2024-2398 | HTTP/2 push headers memory-leak | ≥ 7.44.0 < 8.7.0 | 8.6 | — | 2024-03-27 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).