Проверьте свою версию
curl --versionCVE, затрагивающие 7.78
| CVE | Название | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|
| CVE-2022-32207 | When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by final... | 9.8 | — | 2022-07-07 | |
| CVE-2026-19931 | Negotiate ambient user conn reuse | 9.8 | — | 2026-09-06 | |
| CVE-2022-32221 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask... | 9.8 | — | 2022-12-05 | |
| CVE-2026-11856 | cross-origin Digest auth state leak | 9.8 | — | 2026-07-03 | |
| CVE-2023-23914 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS... | 9.1 | — | 2023-02-23 | |
| CVE-2026-18924 | HTTP/2 server push UAF | 9.1 | — | 2026-09-06 | |
| CVE-2026-8927 | env-set cross-proxy Digest auth state leak | 9.1 | — | 2026-07-03 | |
| CVE-2026-8924 | trailing dot domain super cookie | 9.1 | — | 2026-07-03 | |
| CVE-2023-27533 | A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may all... | 8.8 | — | 2023-03-30 | |
| CVE-2023-27534 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be... | 8.8 | — | 2023-03-30 | |
| CVE-2024-2398 | HTTP/2 push headers memory-leak | 8.6 | — | 2024-03-27 | |
| CVE-2026-82209 | domain-scoped PSL domain cookie | 8.2 | — | 2026-09-06 | |
| CVE-2022-42915 | curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) U... | 8.1 | — | 2022-10-29 | |
| CVE-2022-22576 | An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse... | 8.1 | — | 2022-05-26 | |
| CVE-2026-8286 | wrong STARTTLS connection reuse | 8.1 | — | 2026-07-03 | |
| CVE-2022-27782 | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that... | 7.5 | — | 2022-06-02 | |
| CVE-2021-22946 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP,... | 7.5 | — | 2021-09-29 | |
| CVE-2026-6276 | stale custom cookie host causes cookie leak | 7.5 | — | 2026-05-13 | |
| CVE-2026-80230 | OpenSSL pinning bypass | 7.5 | — | 2026-09-06 | |
| CVE-2026-5773 | wrong reuse of SMB connection | 7.5 | — | 2026-05-13 | |
| CVE-2022-27781 | libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a... | 7.5 | — | 2022-06-02 | |
| CVE-2026-8932 | incomplete mTLS config matching in conn reuse | 7.5 | — | 2026-07-03 | |
| CVE-2022-42916 | In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS sup... | 7.5 | — | 2022-10-29 | |
| CVE-2023-28319 | A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH ser... | 7.5 | — | 2023-05-26 | |
| CVE-2026-80231 | native CA store conn reuse | 7.5 | — | 2026-09-06 | |
| CVE-2022-27775 | An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 a... | 7.5 | — | 2022-06-02 | |
| CVE-2022-43551 | A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using... | 7.5 | — | 2022-12-23 | |
| CVE-2026-9547 | SSH improper host validation | 7.4 | — | 2026-07-03 | |
| CVE-2025-0725 | gzip integer overflow | 7.3 | — | 2025-02-05 | |
| CVE-2022-27776 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cook... | 6.5 | — | 2022-06-02 | |
| CVE-2026-3784 | wrong proxy connection reuse with credentials | 6.5 | — | 2026-03-11 | |
| CVE-2024-9681 | HSTS subdomain overwrites parent cache entry | 6.5 | — | 2024-11-06 | |
| CVE-2026-5545 | wrong reuse of HTTP Negotiate connection | 6.5 | — | 2026-05-13 | |
| CVE-2026-1965 | bad reuse of HTTP Negotiate connection | 6.5 | — | 2026-03-11 | |
| CVE-2024-8096 | OCSP stapling bypass with GnuTLS | 6.5 | — | 2024-09-11 | |
| CVE-2022-32206 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed... | 6.5 | — | 2022-07-07 | |
| CVE-2023-23915 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS... | 6.5 | — | 2023-02-23 | |
| CVE-2026-8458 | wrong reuse for different services | 6.5 | — | 2026-07-03 | |
| CVE-2023-46218 | This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more orig... | 6.5 | — | 2023-12-07 | |
| CVE-2023-23916 | An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "ch... | 6.5 | — | 2023-02-23 | |
| CVE-2025-14017 | broken TLS options for threaded LDAPS | 6.3 | — | 2026-01-08 | |
| CVE-2023-28321 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wil... | 5.9 | — | 2023-05-26 | |
| CVE-2022-43552 | A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols i... | 5.9 | — | 2023-02-09 | |
| CVE-2026-4873 | connection reuse ignores TLS requirement | 5.9 | — | 2026-05-13 | |
| CVE-2022-32208 | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This... | 5.9 | — | 2022-07-07 | |
| CVE-2021-22947 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrad... | 5.9 | — | 2021-09-29 | |
| CVE-2026-6253 | proxy credentials leak over redirect-to proxy | 5.9 | — | 2026-05-13 | |
| CVE-2023-28320 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backend... | 5.9 | — | 2023-05-26 | |
| CVE-2022-27774 | An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affect... | 5.7 | — | 2022-06-02 | |
| CVE-2025-15079 | libssh global known_hosts override | 5.3 | — | 2026-01-08 | |
| CVE-2026-6429 | netrc credential leak with reused proxy connection | 5.3 | — | 2026-05-13 | |
| CVE-2026-7168 | cross-proxy Digest auth state leak | 5.3 | — | 2026-05-13 | |
| CVE-2025-14524 | bearer token leak on cross-protocol redirect | 5.3 | — | 2026-01-08 | |
| CVE-2026-3783 | token leak with redirect and netrc | 5.3 | — | 2026-03-11 | |
| CVE-2025-10966 | missing SFTP host verification with wolfSSH | 4.3 | — | 2025-11-07 | |
| CVE-2022-32205 | A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl <... | 4.3 | — | 2022-07-07 | |
| CVE-2023-28322 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might err... | 3.7 | — | 2023-05-26 | |
| CVE-2022-35252 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes t... | 3.7 | — | 2022-09-23 | |
| CVE-2024-11053 | netrc and redirect credential leak | 3.4 | — | 2024-12-11 | |
| CVE-2025-0167 | netrc and default credential leak | 3.4 | — | 2025-02-05 | |
| CVE-2025-15224 | libssh key passphrase bypass without agent set | 3.1 | — | 2026-01-08 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).