haxx
48 known vulnerabilities affecting haxx products.
Products
Vulnerabilities by priority
| CVE | Priority | EPSS | CVSS | KEV | What |
|---|---|---|---|---|---|
| CVE-2026-19931 | High | 1.2% | 9.8 | A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given ho… | |
| CVE-2026-18924 | High | 0.9% | 9.1 | A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent hand… | |
| CVE-2026-11856 | High | 0.7% | 9.8 | Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) … | |
| CVE-2026-8925 | High | 0.7% | 9.8 | The curl logic that works with SASL authentication could end up cleaning up the … | |
| CVE-2026-8924 | High | 0.7% | 9.1 | A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "sup… | |
| CVE-2026-10536 | High | 0.6% | 9.8 | A use-after-free vulnerability exists in libcurl when an application configures … | |
| CVE-2026-9079 | High | 0.6% | 9.8 | libcurl had a flaw that when instructed to clear proxy authentication credential… | |
| CVE-2026-8927 | High | 0.5% | 9.1 | When reusing a libcurl handle for sequential transfers driven by environment-var… | |
| CVE-2026-8926 | High | 0.4% | 9.1 | When asking curl to use a `.netrc` file to find credentials and at the same time… | |
| CVE-2026-11564 | High | 0.4% | 9.1 | libcurl keeps previously used connections in a connection pool for subsequent tr… | |
| CVE-2025-9086 | Medium | 1.4% | 7.5 | 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is re… | |
| CVE-2026-80231 | Medium | 0.9% | 7.5 | A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for … | |
| CVE-2026-80229 | Medium | 0.9% | 7.5 | When performing transfers via libcurl’s multi interface, pooled TLS connections … | |
| CVE-2026-3805 | Medium | 0.7% | 7.5 | When doing a second SMB request to the same host again, curl would wrongly use a… | |
| CVE-2026-11352 | Medium | 0.7% | 7.5 | An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to… | |
| CVE-2026-80255 | Medium | 0.7% | 7.5 | A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space… | |
| CVE-2026-13608 | Medium | 0.6% | 7.4 | A flaw in the libcurl SASL negotiation for LDAP authentication allows an incompl… | |
| CVE-2026-5773 | Medium | 0.6% | 7.5 | libcurl might in some circumstances reuse the wrong connection for SMB(S) transf… | |
| CVE-2026-11586 | Medium | 0.6% | 7.5 | By default, curl automatically responds to WebSocket PING frames. Because curl l… | |
| CVE-2026-80230 | Medium | 0.6% | 7.5 | When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable stan… | |
| CVE-2026-82209 | Medium | 0.5% | 8.2 | When libpsl support is enabled, libcurl fails to enforce the Public Suffix List … | |
| CVE-2026-9546 | Medium | 0.5% | 7.5 | A vulnerability in libcurl caused the HTTP `Referer:` header to persist even whe… | |
| CVE-2026-82208 | Medium | 0.4% | 7.5 | With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUN… | |
| CVE-2026-12064 | Medium | 0.4% | 7.5 | When a user invokes curl using a schemeless URL combined with `--proto-default` … | |
| CVE-2026-8932 | Medium | 0.4% | 7.5 | libcurl would reuse a previously created connection even when some mTLS config r… | |
| CVE-2026-9547 | Medium | 0.3% | 7.4 | When a libcurl-based application performs transfers via `SCP://` or `SFTP://` an… | |
| CVE-2026-8286 | Medium | 0.3% | 8.1 | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the co… | |
| CVE-2026-6276 | Medium | 0.3% | 7.5 | Using libcurl, when a custom `Host:` header is first set for an HTTP request and… | |
| CVE-2026-9080 | Medium | 0.3% | 7.3 | Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` cal… | |
| CVE-2026-9545 | Medium | 0.3% | 7.5 | In this scenario, libcurl first uses a proper HTTP/3 server for the initial tran… | |
| CVE-2025-14819 | Low | 0.7% | 5.3 | When doing TLS related transfers with reused easy or multi handles and altering … | |
| CVE-2026-6253 | Low | 0.7% | 5.9 | curl might erroneously pass on credentials for a first proxy to a second proxy. … | |
| CVE-2025-14524 | Low | 0.7% | 5.3 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer p… | |
| CVE-2025-15079 | Low | 0.5% | 5.3 | When doing SSH-based transfers using either SCP or SFTP, and setting the known_h… | |
| CVE-2026-6429 | Low | 0.5% | 5.3 | When asked to both use a `.netrc` file for credentials and to follow HTTP redire… | |
| CVE-2025-10148 | Low | 0.5% | 5.3 | curl's WebSocket code did not update the 32-bit mask pattern for each new outgoi… | |
| CVE-2025-15224 | Low | 0.5% | 3.1 | When doing SSH-based transfers using either SCP or SFTP, and asked to do public … | |
| CVE-2026-7168 | Low | 0.5% | 5.3 | Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`… | |
| CVE-2026-3783 | Low | 0.5% | 5.3 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer p… | |
| CVE-2026-5545 | Low | 0.4% | 6.5 | libcurl might in some circumstances reuse the wrong connection when asked to do … | |
| CVE-2026-3784 | Low | 0.4% | 6.5 | curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a se… | |
| CVE-2025-10966 | Low | 0.4% | 4.3 | curl's code for managing SSH connections when SFTP was done using the wolfSSH po… | |
| CVE-2026-8458 | Low | 0.4% | 6.5 | libcurl might in some circumstances reuse the wrong connection when asked to do … | |
| CVE-2020-19909 | Low | 0.4% | 3.3 | Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large valu… | |
| CVE-2026-4873 | Low | 0.3% | 5.9 | A vulnerability exists where a connection requiring TLS incorrectly reuses an ex… | |
| CVE-2026-1965 | Low | 0.3% | 6.5 | libcurl can in some circumstances reuse the wrong connection when asked to do an… | |
| CVE-2025-13034 | Low | 0.2% | 5.9 | When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` wit… | |
| CVE-2025-14017 | Low | 0.1% | 6.3 | When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing… |