漏洞历史说明了什么
该软件记录有 169 个 CVE，最高 CVSS 得分为 9.8，已知被利用的漏洞数为 0。
如何保障安全
运维人员应确保使用受支持的发布版本并跟踪已安装的软件版本，以保持安全性。
检查您的版本
curl --version受影响的版本系列
- 8.21 9 个 CVE
- 8.20 26 个 CVE
- 8.19 35 个 CVE
- 8.18 38 个 CVE
- 8.17 43 个 CVE
- 8.16 42 个 CVE
- 8.15 43 个 CVE
- 8.14 43 个 CVE
- 8.13 44 个 CVE
- 8.12 39 个 CVE
- 8.11 43 个 CVE
- 8.10 40 个 CVE
- 8.9 41 个 CVE
- 8.8 40 个 CVE
- 8.7 37 个 CVE
- 8.6 41 个 CVE
- 8.5 41 个 CVE
- 8.4 40 个 CVE
- 8.3 40 个 CVE
- 8.1 41 个 CVE
- 7.881 45 个 CVE
- 7.88 47 个 CVE
- 7.87 49 个 CVE
- 7.86 50 个 CVE
- 7.85 54 个 CVE
- 7.84 54 个 CVE
- 7.83 61 个 CVE
- 7.82 64 个 CVE
- 7.81 61 个 CVE
- 7.80 60 个 CVE
- 7.79 59 个 CVE
- 7.78 61 个 CVE
- 7.77 65 个 CVE
- 7.76 63 个 CVE
- 7.75 61 个 CVE
- 7.74 60 个 CVE
- 7.73 60 个 CVE
- 7.71 60 个 CVE
- 7.70 59 个 CVE
- 7.69 59 个 CVE
- 7.65 60 个 CVE
- 7.64 59 个 CVE
- 7.62 58 个 CVE
- 7.61 59 个 CVE
- 7.60 59 个 CVE
- 7.59 61 个 CVE
- 7.58 63 个 CVE
- 7.57 62 个 CVE
- 7.56 64 个 CVE
- 7.55 64 个 CVE
- 7.54 65 个 CVE
- 7.53 64 个 CVE
- 7.52 65 个 CVE
- 7.51 67 个 CVE
- 7.50 77 个 CVE
- 7.49 79 个 CVE
- 7.48 80 个 CVE
- 7.47 80 个 CVE
- 7.46 82 个 CVE
- 7.45 78 个 CVE
- 7.44 77 个 CVE
- 7.43 75 个 CVE
- 7.42 78 个 CVE
- 7.41 82 个 CVE
- 7.40 81 个 CVE
- 7.39 78 个 CVE
- 7.38 78 个 CVE
- 7.37 79 个 CVE
- 7.36 79 个 CVE
- 7.35 81 个 CVE
- 7.34 81 个 CVE
- 7.33 81 个 CVE
- 7.32 77 个 CVE
- 7.31 77 个 CVE
- 7.30 77 个 CVE
- 7.29 75 个 CVE
- 7.28 76 个 CVE
- 7.27 76 个 CVE
- 7.26 73 个 CVE
- 7.25 72 个 CVE
- 7.24 72 个 CVE
- 7.23 73 个 CVE
- 7.22 73 个 CVE
- 7.21 73 个 CVE
- 7.20 70 个 CVE
- 7.19 65 个 CVE
- 7.18 63 个 CVE
- 7.17 61 个 CVE
- 7.16 60 个 CVE
- 7.15 59 个 CVE
- 7.14 59 个 CVE
- 7.13 56 个 CVE
- 7.12 57 个 CVE
- 7.11 53 个 CVE
- 7.10 54 个 CVE
- 7.9 44 个 CVE
- 7.8 44 个 CVE
- 7.7 44 个 CVE
- 7.6 43 个 CVE
- 7.5 39 个 CVE
- 7.4 40 个 CVE
- 7.3 39 个 CVE
- 7.2 39 个 CVE
- 7.1 39 个 CVE
- 7.0 38 个 CVE
- 6.5 36 个 CVE
- 6.4 36 个 CVE
- 6.3 36 个 CVE
- 6.2 36 个 CVE
- 6.1 36 个 CVE
- 6.0 36 个 CVE
- 4.9 36 个 CVE
已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2026-80229 | OpenSSL provider use-after-free | ≥ 8.14.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-80230 | OpenSSL pinning bypass | ≥ 7.45.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-80231 | native CA store conn reuse | ≥ 7.71.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-80255 | secure cookie attribute bypass with tab | ≥ 8.13.0 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-82208 | wolfSSL CA-cache hit overrides callback | ≥ 8.9.1 < 8.22.0 | 7.5 | — | 2026-09-06 | |
| CVE-2026-82209 | domain-scoped PSL domain cookie | ≥ 7.46.0 < 8.22.0 | 8.2 | — | 2026-09-06 | |
| CVE-2026-18924 | HTTP/2 server push UAF | ≥ 7.44.0 < 8.22.0 | 9.1 | — | 2026-09-06 | |
| CVE-2026-19931 | Negotiate ambient user conn reuse | ≥ 7.64.1 < 8.22.0 | 9.8 | — | 2026-09-06 | |
| CVE-2026-13608 | OpenLDAP SASL authentication bypass | ≥ 7.82.0 < 8.22.0 | 7.4 | — | 2026-09-06 | |
| CVE-2026-8926 | password leak with netrc and user in URL | ≥ 8.11.1 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-8927 | env-set cross-proxy Digest auth state leak | ≥ 7.12.0 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-8932 | incomplete mTLS config matching in conn reuse | ≥ 7.7 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-9079 | stale proxy password leak | ≥ 8.8.0 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-9080 | UAF after pause in socket callback | ≥ 8.13.0 < 8.21.0 | 7.3 | — | 2026-07-03 | |
| CVE-2026-9545 | exposing HTTP/3 early data | ≥ 8.11.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-9546 | sending old referer | ≥ 8.18.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-9547 | SSH improper host validation | ≥ 7.69.0 < 8.21.0 | 7.4 | — | 2026-07-03 | |
| CVE-2026-12064 | proto-default skips SSH verification | ≥ 7.81.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-8286 | wrong STARTTLS connection reuse | ≥ 7.30.0 < 8.21.0 | 8.1 | — | 2026-07-03 | |
| CVE-2026-8458 | wrong reuse for different services | ≥ 7.46.0 < 8.20.0 | 6.5 | — | 2026-07-03 | |
| CVE-2026-8924 | trailing dot domain super cookie | ≥ 7.46.0 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-8925 | SASL double-free | ≥ 8.15.0 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-10536 | HTTP/2 stream-dependency tree UAF | ≥ 7.88.0 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-11352 | QUIC zero-length UDP datagrams busy-loop | ≥ 8.18.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-11564 | Native CA trust persist | ≥ 8.17.0 < 8.21.0 | 9.1 | — | 2026-07-03 | |
| CVE-2026-11586 | WS Auto-PONG memory exhaustion | ≥ 8.16.0 < 8.21.0 | 7.5 | — | 2026-07-03 | |
| CVE-2026-11856 | cross-origin Digest auth state leak | ≥ 7.10.6 < 8.21.0 | 9.8 | — | 2026-07-03 | |
| CVE-2026-7009 | OCSP stapling bypass with Apple SecTrust | ≥ 8.17.0 < 8.20.0 | 5.3 | — | 2026-05-13 | |
| CVE-2026-7168 | cross-proxy Digest auth state leak | ≥ 7.12.0 < 8.20.0 | 5.3 | — | 2026-05-13 | |
| CVE-2026-5545 | wrong reuse of HTTP Negotiate connection | ≥ 7.10.6 < 8.20.0 | 6.5 | — | 2026-05-13 | |
| CVE-2026-5773 | wrong reuse of SMB connection | ≥ 7.40.0 < 8.20.0 | 7.5 | — | 2026-05-13 | |
| CVE-2026-6253 | proxy credentials leak over redirect-to proxy | ≥ 7.14.1 < 8.20.0 | 5.9 | — | 2026-05-13 | |
| CVE-2026-6276 | stale custom cookie host causes cookie leak | ≥ 7.71.0 < 8.20.0 | 7.5 | — | 2026-05-13 | |
| CVE-2026-6429 | netrc credential leak with reused proxy connection | ≥ 7.14.0 < 8.20.0 | 5.3 | — | 2026-05-13 | |
| CVE-2026-4873 | connection reuse ignores TLS requirement | ≥ 7.20.0 < 8.20.0 | 5.9 | — | 2026-05-13 | |
| CVE-2026-3783 | token leak with redirect and netrc | ≥ 7.33.0 < 8.19.0 | 5.3 | — | 2026-03-11 | |
| CVE-2026-3784 | wrong proxy connection reuse with credentials | ≥ 7.7 < 8.18.0 | 6.5 | — | 2026-03-11 | |
| CVE-2026-3805 | use after free in SMB connection reuse | ≥ 8.13.0 < 8.19.0 | 7.5 | — | 2026-03-11 | |
| CVE-2026-1965 | bad reuse of HTTP Negotiate connection | ≥ 7.10.6 < 8.19.0 | 6.5 | — | 2026-03-11 | |
| CVE-2025-15079 | libssh global known_hosts override | ≥ 7.58.0 < 8.18.0 | 5.3 | — | 2026-01-08 | |
| CVE-2025-15224 | libssh key passphrase bypass without agent set | ≥ 7.58.0 < 8.18.0 | 3.1 | — | 2026-01-08 | |
| CVE-2025-14524 | bearer token leak on cross-protocol redirect | ≥ 7.33.0 < 8.18.0 | 5.3 | — | 2026-01-08 | |
| CVE-2025-14819 | OpenSSL partial chain store policy bypass | ≥ 7.87.0 < 8.18.0 | 5.3 | — | 2026-01-08 | |
| CVE-2025-13034 | No QUIC certificate pinning with GnuTLS | ≥ 8.8.0 < 8.18.0 | 5.9 | — | 2026-01-08 | |
| CVE-2025-14017 | broken TLS options for threaded LDAPS | ≥ 7.17.0 < 8.18.0 | 6.3 | — | 2026-01-08 | |
| CVE-2025-10966 | missing SFTP host verification with wolfSSH | ≥ 7.69.0 < 8.17.0 | 4.3 | — | 2025-11-07 | |
| CVE-2025-9086 | Out of bounds read for cookie path | ≥ 8.13.0 < 8.16.0 | 7.5 | — | 2025-09-12 | |
| CVE-2025-10148 | predictable WebSocket mask | ≥ 8.11.0 < 8.16.0 | 5.3 | — | 2025-09-12 | |
| CVE-2025-5399 | WebSocket endless loop | ≥ 8.13.0 < 8.14.1 | 7.5 | — | 2025-06-07 | |
| CVE-2025-4947 | QUIC certificate check skip with wolfSSL | ≥ 8.8.0 < 8.14.0 | 6.5 | — | 2025-05-28 | |
| CVE-2025-5025 | No QUIC certificate pinning with wolfSSL | ≥ 8.5.0 < 8.14.0 | 4.8 | — | 2025-05-28 | |
| CVE-2025-0167 | netrc and default credential leak | ≥ 7.76.0 < 8.12.0 | 3.4 | — | 2025-02-05 | |
| CVE-2025-0665 | eventfd double close | = 8.11.1 | 7.0 | — | 2025-02-05 | |
| CVE-2025-0725 | gzip integer overflow | ≥ 7.10.5 < 8.12.0 | 7.3 | — | 2025-02-05 | |
| CVE-2024-11053 | netrc and redirect credential leak | ≥ 7.76.0 < 8.11.1 | 3.4 | — | 2024-12-11 | |
| CVE-2024-9681 | HSTS subdomain overwrites parent cache entry | ≥ 7.74.0 < 8.11.0 | 6.5 | — | 2024-11-06 | |
| CVE-2024-8096 | OCSP stapling bypass with GnuTLS | ≥ 7.41.0 < 8.10.0 | 6.5 | — | 2024-09-11 | |
| CVE-2024-2004 | Usage of disabled protocol | ≥ 7.85.0 < 8.7.0 | 3.5 | — | 2024-03-27 | |
| CVE-2024-2379 | QUIC certificate check bypass with wolfSSL | = 8.6.0 | 6.3 | — | 2024-03-27 | |
| CVE-2024-2398 | HTTP/2 push headers memory-leak | ≥ 7.44.0 < 8.7.0 | 8.6 | — | 2024-03-27 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。