過去の脆弱性から分かること
このソフトウェアには、最大CVSSスコア9.8の記録されたCVEが169件あり、悪用が確認されている脆弱性は0件です。
安全に運用するには
運用者は、セキュリティを維持するためにサポートされているリリースラインにとどまり、インストールされているソフトウェアのバージョンを追跡する必要があります。
バージョンを確認する
curl --version影響を受けるバージョン系列
- 8.21 CVE 9 件
- 8.20 CVE 26 件
- 8.19 CVE 35 件
- 8.18 CVE 38 件
- 8.17 CVE 43 件
- 8.16 CVE 42 件
- 8.15 CVE 43 件
- 8.14 CVE 43 件
- 8.13 CVE 44 件
- 8.12 CVE 39 件
- 8.11 CVE 43 件
- 8.10 CVE 40 件
- 8.9 CVE 41 件
- 8.8 CVE 40 件
- 8.7 CVE 37 件
- 8.6 CVE 41 件
- 8.5 CVE 41 件
- 8.4 CVE 40 件
- 8.3 CVE 40 件
- 8.1 CVE 41 件
- 7.881 CVE 45 件
- 7.88 CVE 47 件
- 7.87 CVE 49 件
- 7.86 CVE 50 件
- 7.85 CVE 54 件
- 7.84 CVE 54 件
- 7.83 CVE 61 件
- 7.82 CVE 64 件
- 7.81 CVE 61 件
- 7.80 CVE 60 件
- 7.79 CVE 59 件
- 7.78 CVE 61 件
- 7.77 CVE 65 件
- 7.76 CVE 63 件
- 7.75 CVE 61 件
- 7.74 CVE 60 件
- 7.73 CVE 60 件
- 7.71 CVE 60 件
- 7.70 CVE 59 件
- 7.69 CVE 59 件
- 7.65 CVE 60 件
- 7.64 CVE 59 件
- 7.62 CVE 58 件
- 7.61 CVE 59 件
- 7.60 CVE 59 件
- 7.59 CVE 61 件
- 7.58 CVE 63 件
- 7.57 CVE 62 件
- 7.56 CVE 64 件
- 7.55 CVE 64 件
- 7.54 CVE 65 件
- 7.53 CVE 64 件
- 7.52 CVE 65 件
- 7.51 CVE 67 件
- 7.50 CVE 77 件
- 7.49 CVE 79 件
- 7.48 CVE 80 件
- 7.47 CVE 80 件
- 7.46 CVE 82 件
- 7.45 CVE 78 件
- 7.44 CVE 77 件
- 7.43 CVE 75 件
- 7.42 CVE 78 件
- 7.41 CVE 82 件
- 7.40 CVE 81 件
- 7.39 CVE 78 件
- 7.38 CVE 78 件
- 7.37 CVE 79 件
- 7.36 CVE 79 件
- 7.35 CVE 81 件
- 7.34 CVE 81 件
- 7.33 CVE 81 件
- 7.32 CVE 77 件
- 7.31 CVE 77 件
- 7.30 CVE 77 件
- 7.29 CVE 75 件
- 7.28 CVE 76 件
- 7.27 CVE 76 件
- 7.26 CVE 73 件
- 7.25 CVE 72 件
- 7.24 CVE 72 件
- 7.23 CVE 73 件
- 7.22 CVE 73 件
- 7.21 CVE 73 件
- 7.20 CVE 70 件
- 7.19 CVE 65 件
- 7.18 CVE 63 件
- 7.17 CVE 61 件
- 7.16 CVE 60 件
- 7.15 CVE 59 件
- 7.14 CVE 59 件
- 7.13 CVE 56 件
- 7.12 CVE 57 件
- 7.11 CVE 53 件
- 7.10 CVE 54 件
- 7.9 CVE 44 件
- 7.8 CVE 44 件
- 7.7 CVE 44 件
- 7.6 CVE 43 件
- 7.5 CVE 39 件
- 7.4 CVE 40 件
- 7.3 CVE 39 件
- 7.2 CVE 39 件
- 7.1 CVE 39 件
- 7.0 CVE 38 件
- 6.5 CVE 36 件
- 6.4 CVE 36 件
- 6.3 CVE 36 件
- 6.2 CVE 36 件
- 6.1 CVE 36 件
- 6.0 CVE 36 件
- 4.9 CVE 36 件
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-80229 | OpenSSL provider use-after-free | ≥ 8.14.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-80230 | OpenSSL pinning bypass | ≥ 7.45.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-80231 | native CA store conn reuse | ≥ 7.71.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-80255 | secure cookie attribute bypass with tab | ≥ 8.13.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-82208 | wolfSSL CA-cache hit overrides callback | ≥ 8.9.1 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-82209 | domain-scoped PSL domain cookie | ≥ 7.46.0 < 8.22.0 | 8.2 | — | 2026-09-06 | |
| CVE-2026-18924 | HTTP/2 server push UAF | ≥ 7.44.0 < 8.22.0 | 9.1 | — | 2026-09-06 | |
| CVE-2026-19931 | Negotiate ambient user conn reuse | ≥ 7.64.1 < 8.22.0 | 9.8 | — | 2026-09-06 | |
| CVE-2026-13608 | OpenLDAP SASL authentication bypass | ≥ 7.82.0 < 8.22.0 | 7.4 | — | 2026-09-06 | |
| CVE-2026-8926 | password leak with netrc and user in URL | ≥ 8.11.1 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-8927 | env-set cross-proxy Digest auth state leak | ≥ 7.12.0 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-8932 | incomplete mTLS config matching in conn reuse | ≥ 7.7 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-9079 | stale proxy password leak | ≥ 8.8.0 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-9080 | UAF after pause in socket callback | ≥ 8.13.0 < 8.21.0 | 7.3 | — | 2026-07-03 | |
| CVE-2026-9545 | exposing HTTP/3 early data | ≥ 8.11.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-9546 | sending old referer | ≥ 8.18.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-9547 | SSH improper host validation | ≥ 7.69.0 < 8.21.0 | 7.4 | — | 2026-07-03 | |
| CVE-2026-12064 | proto-default skips SSH verification | ≥ 7.81.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-8286 | wrong STARTTLS connection reuse | ≥ 7.30.0 < 8.21.0 | 8.1 | — | 2026-07-03 | |
| CVE-2026-8458 | wrong reuse for different services | ≥ 7.46.0 < 8.20.0 | 6.5 | — | 2026-07-03 | |
| CVE-2026-8924 | trailing dot domain super cookie | ≥ 7.46.0 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-8925 | SASL double-free | ≥ 8.15.0 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-10536 | HTTP/2 stream-dependency tree UAF | ≥ 7.88.0 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-11352 | QUIC zero-length UDP datagrams busy-loop | ≥ 8.18.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-11564 | Native CA trust persist | ≥ 8.17.0 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-11586 | WS Auto-PONG memory exhaustion | ≥ 8.16.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-11856 | cross-origin Digest auth state leak | ≥ 7.10.6 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-7009 | OCSP stapling bypass with Apple SecTrust | ≥ 8.17.0 < 8.20.0 | 5.3 | — | 2026-05-13 | |
| CVE-2026-7168 | cross-proxy Digest auth state leak | ≥ 7.12.0 < 8.20.0 | 5.3 | — | 2026-05-13 | |
| CVE-2026-5545 | wrong reuse of HTTP Negotiate connection | ≥ 7.10.6 < 8.20.0 | 6.5 | — | 2026-05-13 | |
| CVE-2026-5773 | wrong reuse of SMB connection | ≥ 7.40.0 < 8.20.0 | 7.5 | — | 2026-05-13 | |
| CVE-2026-6253 | proxy credentials leak over redirect-to proxy | ≥ 7.14.1 < 8.20.0 | 5.9 | — | 2026-05-13 | |
| CVE-2026-6276 | stale custom cookie host causes cookie leak | ≥ 7.71.0 < 8.20.0 | 7.5 | — | 2026-05-13 | |
| CVE-2026-6429 | netrc credential leak with reused proxy connection | ≥ 7.14.0 < 8.20.0 | 5.3 | — | 2026-05-13 | |
| CVE-2026-4873 | connection reuse ignores TLS requirement | ≥ 7.20.0 < 8.20.0 | 5.9 | — | 2026-05-13 | |
| CVE-2026-3783 | token leak with redirect and netrc | ≥ 7.33.0 < 8.19.0 | 5.3 | — | 2026-03-11 | |
| CVE-2026-3784 | wrong proxy connection reuse with credentials | ≥ 7.7 < 8.18.0 | 6.5 | — | 2026-03-11 | |
| CVE-2026-3805 | use after free in SMB connection reuse | ≥ 8.13.0 < 8.19.0 | 7.5 | — | 2026-03-11 | |
| CVE-2026-1965 | bad reuse of HTTP Negotiate connection | ≥ 7.10.6 < 8.19.0 | 6.5 | — | 2026-03-11 | |
| CVE-2025-15079 | libssh global known_hosts override | ≥ 7.58.0 < 8.18.0 | 5.3 | — | 2026-01-08 | |
| CVE-2025-15224 | libssh key passphrase bypass without agent set | ≥ 7.58.0 < 8.18.0 | 3.1 | — | 2026-01-08 | |
| CVE-2025-14524 | bearer token leak on cross-protocol redirect | ≥ 7.33.0 < 8.18.0 | 5.3 | — | 2026-01-08 | |
| CVE-2025-14819 | OpenSSL partial chain store policy bypass | ≥ 7.87.0 < 8.18.0 | 5.3 | — | 2026-01-08 | |
| CVE-2025-13034 | No QUIC certificate pinning with GnuTLS | ≥ 8.8.0 < 8.18.0 | 5.9 | — | 2026-01-08 | |
| CVE-2025-14017 | broken TLS options for threaded LDAPS | ≥ 7.17.0 < 8.18.0 | 6.3 | — | 2026-01-08 | |
| CVE-2025-10966 | missing SFTP host verification with wolfSSH | ≥ 7.69.0 < 8.17.0 | 4.3 | — | 2025-11-07 | |
| CVE-2025-9086 | Out of bounds read for cookie path | ≥ 8.13.0 < 8.16.0 | 7.5 | — | 2025-09-12 | |
| CVE-2025-10148 | predictable WebSocket mask | ≥ 8.11.0 < 8.16.0 | 5.3 | — | 2025-09-12 | |
| CVE-2025-5399 | WebSocket endless loop | ≥ 8.13.0 < 8.14.1 | 7.5 | — | 2025-06-07 | |
| CVE-2025-4947 | QUIC certificate check skip with wolfSSL | ≥ 8.8.0 < 8.14.0 | 6.5 | — | 2025-05-28 | |
| CVE-2025-5025 | No QUIC certificate pinning with wolfSSL | ≥ 8.5.0 < 8.14.0 | 4.8 | — | 2025-05-28 | |
| CVE-2025-0167 | netrc and default credential leak | ≥ 7.76.0 < 8.12.0 | 3.4 | — | 2025-02-05 | |
| CVE-2025-0665 | eventfd double close | = 8.11.1 | 7.0 | — | 2025-02-05 | |
| CVE-2025-0725 | gzip integer overflow | ≥ 7.10.5 < 8.12.0 | 7.3 | — | 2025-02-05 | |
| CVE-2024-11053 | netrc and redirect credential leak | ≥ 7.76.0 < 8.11.1 | 3.4 | — | 2024-12-11 | |
| CVE-2024-9681 | HSTS subdomain overwrites parent cache entry | ≥ 7.74.0 < 8.11.0 | 6.5 | — | 2024-11-06 | |
| CVE-2024-8096 | OCSP stapling bypass with GnuTLS | ≥ 7.41.0 < 8.10.0 | 6.5 | — | 2024-09-11 | |
| CVE-2024-2004 | Usage of disabled protocol | ≥ 7.85.0 < 8.7.0 | 3.5 | — | 2024-03-27 | |
| CVE-2024-2379 | QUIC certificate check bypass with wolfSSL | = 8.6.0 | 6.3 | — | 2024-03-27 | |
| CVE-2024-2398 | HTTP/2 push headers memory-leak | ≥ 7.44.0 < 8.7.0 | 8.6 | — | 2024-03-27 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。