Critical Curl Vulnerabilities Patched: Update Now
Key Takeaways The curl project has released version 8.23.0, addressing 24 security vulnerabilities in both the curl tool and its libcurl library. These flaws include credential leaks, authentication...
Key Takeaways
- The curl project has released version 8.23.0, addressing 24 security vulnerabilities in both the curl tool and its libcurl library.
- These flaws include credential leaks, authentication bypasses, command injection, and denial-of-service risks.
- Eighteen of the patched vulnerabilities were discovered through an audit by security firm AISLE.
- Immediate updates to curl 8.23.0 are strongly recommended for all users and developers.
The curl project has issued a critical update, version 8.23.0, on October 14, 2026, to resolve a total of 24 security vulnerabilities impacting the widely adopted data transfer utility and its underlying library, libcurl. These patches address a range of serious issues, from credential exposure and authentication failures to command injection and application stability problems. Users are also advised that the update removes support for the SMB and SMBS protocols, necessitating compatibility assessments before deployment. Further details can be found in the official curl release notes.
According to security firm AISLE, their dedicated audit was responsible for uncovering 18 of the 24 vulnerabilities disclosed in this release, representing a significant 75% of the total. AISLE’s comprehensive audit identified 24 CVEs across two curl releases, with six addressed in version 8.22.0 and the remaining eighteen fixed in 8.23.0. It is important to note that these figures reflect AISLE’s audit findings and do not represent the complete security vulnerability count for either release.
Critical Security Vulnerabilities Addressed
Among the most critical issues is CVE-2026-86414, a flaw that could allow an HTTP proxy to trick libcurl into divulging credentials intended for the actual destination server. This occurs when, during a CONNECT tunnel request, a malicious proxy responds with a 401 Unauthorized status and a WWW-Authenticate header, instead of the expected proxy authentication challenge. This manipulation could lead to the exposure of Basic authentication passwords or Negotiate/Kerberos tickets. This vulnerability affects curl versions 7.10.8 through 8.22.0.
Another significant vulnerability, CVE-2026-94266, presents a password leakage risk through the CURLINFO_EFFECTIVE_URL interface. When curl retrieves credentials from a .netrc file, the effective URL returned by this function, or displayed via the command-line tool’s url_effective output, can include the embedded password. This means applications logging these URLs could inadvertently store sensitive credentials in log files. Versions 7.62.0 through 8.22.0 are susceptible to this issue.
These findings underscore a persistent concern regarding curl’s handling of credentials, building on previous reports of password leaks involving redirects and .netrc files, where credentials could be sent to unintended hosts under specific scenarios.
The official advisory for CVE-2026-87864 details an IMAP command injection vulnerability. This flaw arises during IMAP message uploads when the CURLOPT_CRLF option is used. Curl would advertise the original message size but transmit additional bytes after converting line endings. A vulnerable mail server could misinterpret these extra bytes as additional IMAP commands within an authenticated session. It is important to clarify that this is an IMAP command injection, not an operating system shell command injection.
While the advisory for CVE-2026-87864 was published on October 14, this particular vulnerability was already patched in curl 8.22.0. It affected versions 7.30.0 through 8.21.0 and is rated as low severity. A documented workaround involves avoiding the use of CURLOPT_CRLF with IMAP. This follows a recent patch for a 25-year-old vulnerability in curl version 8.21.0.
Additional vulnerabilities identified by AISLE include issues such as stale AWS signing headers being sent to incorrect destinations, credentials crossing redirect boundaries, mix-ups in client certificate usage, corrupted cookie storage, and improper handling of the HSTS cache. Other flaws could lead to endless loops or process stack exhaustion, often stemming from the persistence of settings or connection states after changes in destination or identity.
| CVE ID | Vulnerability | Affected feature | Security impact |
|---|---|---|---|
| CVE-2026-86409 | Stale AWS SigV4 headers sent to an unintended destination | AWS request signing | Authentication headers can remain attached to a request after its destination changes. |
| CVE-2026-86410 | Redirect bypasses SSH host verification | SFTP and SCP redirects | A redirected connection can skip the host verification needed to confirm the remote server’s identity. |
| CVE-2026-86411 | Reused FTP connection inherits a client certificate | FTP connection reuse | A transfer can reuse a connection authenticated with a client certificate from a previous configuration. |
| CVE-2026-86412 | Server-set cookie erases the cookie jar | Cookie storage | A server-provided cookie can cause stored cookies to be erased. |
| CVE-2026-86413 | Negotiate credentials sent to a redirected origin | Redirects and Negotiate authentication | Authentication information can reach a destination that should not receive it. |
| CVE-2026-86414 | Host credentials leaked to an HTTP proxy | HTTP proxy CONNECT handling | A proxy can obtain credentials intended for the destination server, including Basic authentication passwords or Negotiate/Kerberos tickets. |
| CVE-2026-86415 | Automatic client-certificate connection reuse mix-up | Client certificates and connection reuse | A connection can be reused under the wrong client-certificate identity. |
| CVE-2026-87862 | HSTS cache import drops a longer-lived child entry | HSTS cache loading | An existing child-domain entry with a longer lifetime can be lost during cache import. |
| CVE-2026-87863 | HSTS response erases persisted entries | HSTS cache persistence | Processing a server’s HSTS response can erase stored HTTPS enforcement entries. |
| CVE-2026-87864 | IMAP APPEND command injection during CRLF conversion | IMAP uploads and CURLOPT_CRLF |
A mismatch between the declared message size and transmitted bytes can let extra bytes become IMAP commands in an authenticated session. This is not operating system shell injection. |
| CVE-2026-92386 | Server-set cookie aborts cookie-jar loading | Cookie-file loading | A server-provided cookie can interrupt the loading of stored cookies. |
| CVE-2026-92387 | Missing server response data causes a never-ending loop | Server response handling | The affected operation can become stuck in an endless loop, disrupting the application. |
| CVE-2026-92388 | FTP wildcard write callback mix-up | FTP wildcard transfers | Transfer data can reach the wrong application write callback. |
| CVE-2026-92389 | TFTP transfer direction confusion | TFTP transfers | Curl can confuse the intended transfer direction, causing incorrect protocol behavior. |
| CVE-2026-92390 | -J no-clobber protection bypassed through 103 Early Hints |
HTTP response headers and output-file handling | An HTTP 103 Early Hints response can bypass protection intended to prevent overwriting an existing file. |
| CVE-2026-92391 | Recursive curl_mime_free calls exhaust the stack |
MIME cleanup | Recursive cleanup can exhaust the process stack and crash the application. |
| CVE-2026-94265 | Authorization: Negotiate sent to a foreign origin |
HTTP Negotiate authentication | An authentication header can be sent to a different origin that should not receive it. |
| CVE-2026-94266 |
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
No Comment! Be the first one.