Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info

CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket

Changelog curl CVEs Release Table Version Numbering Vulnerabilities

Tool

Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added

Companies Copyright Sponsors Thanks The name

curl / Docs / Vulnerability table / 8.6.0 vulnerabilities

Vulnerabilities in curl 8.6.0

Related:
Audits
Bug Bounty
Changelog
curl CVEs
Vulnerability Disclosure
Vulnerabilities Table

curl version 8.6.0 was released on January 31 2024

It has the following 13 published security problems.

Flaw	From version	To and including
Out of bounds read for cookie path	7.31.0	8.15.0
No QUIC certificate pinning with wolfSSL	8.5.0	8.13.0
gzip integer overflow	7.10.5	8.11.1
netrc and default credential leak	7.76.0	8.11.1
netrc and redirect credential leak	7.76.0	8.11.0
HSTS subdomain overwrites parent cache entry	7.74.0	8.10.1
OCSP stapling bypass with GnuTLS	7.41.0	8.9.1
ASN.1 date parser overread	7.32.0	8.9.0
freeing stack buffer in utf8asn1str	8.6.0	8.8.0
TLS certificate check bypass with mbedTLS	8.5.0	8.6.0
HTTP/2 push headers memory-leak	7.44.0	8.6.0
QUIC certificate check bypass with wolfSSL	8.6.0	8.6.0
Usage of disabled protocol	7.85.0	8.6.0

Further details

CVE data for 8.6.0 provided as JSON.

Changelog for curl 8.6.0

See vulnerability summary for the previous release: 8.5.0 or the subsequent release: 8.7.0