curl / Docs / Vulnerability table / 7.87.0 vulnerabilities

Vulnerabilities in curl 7.87.0

curl version 7.87.0 was released on December 21 2022

It has the following 49 published security problems.

S	Flaw	First	Last
L	CVE-2026-12064: proto-default skips SSH verification	7.81.0	8.20.0
M	CVE-2026-11856: cross-origin Digest auth state leak	7.10.6	8.20.0
L	CVE-2026-9547: SSH improper host validation	7.69.0	8.20.0
L	CVE-2026-8932: incomplete mTLS config matching in conn reuse	7.7	8.20.0
M	CVE-2026-8927: env-set cross-proxy Digest auth state leak	7.12.0	8.20.0
L	CVE-2026-8924: trailing dot domain super cookie	7.46.0	8.20.0
L	CVE-2026-8458: wrong reuse for different services	7.43.0	8.20.0
L	CVE-2026-8286: wrong STARTTLS connection reuse	7.30.0	8.20.0
M	CVE-2026-7168: cross-proxy Digest auth state leak	7.12.0	8.19.0
M	CVE-2026-6429: netrc credential leak with reused proxy connection	7.14.0	8.19.0
L	CVE-2026-6276: stale custom cookie host causes cookie leak	7.71.0	8.19.0
M	CVE-2026-6253: proxy credentials leak over redirect-to proxy	7.14.1	8.19.0
L	CVE-2026-5773: wrong reuse of SMB connection	7.40.0	8.19.0
M	CVE-2026-5545: wrong reuse of HTTP Negotiate connection	7.10.6	8.19.0
L	CVE-2026-4873: connection reuse ignores TLS requirement	7.20.0	8.19.0
L	CVE-2026-3784: wrong proxy connection reuse with credentials	7.7	8.18.0
M	CVE-2026-3783: token leak with redirect and netrc	7.33.0	8.18.0
M	CVE-2026-1965: bad reuse of HTTP Negotiate connection	7.10.6	8.18.0
L	CVE-2025-15224: libssh key passphrase bypass without agent set	7.58.0	8.17.0
L	CVE-2025-15079: libssh global known_hosts override	7.58.0	8.17.0
L	CVE-2025-14819: OpenSSL partial chain store policy bypass	7.87.0	8.17.0
L	CVE-2025-14524: bearer token leak on cross-protocol redirect	7.33.0	8.17.0
M	CVE-2025-14017: broken TLS options for threaded LDAPS	7.17.0	8.17.0
L	CVE-2025-10966: missing SFTP host verification with wolfSSH	7.69.0	8.16.0
L	CVE-2025-0725: gzip integer overflow	7.10.5	8.11.1
L	CVE-2025-0167: netrc and default credential leak	7.76.0	8.11.1
L	CVE-2024-11053: netrc and redirect credential leak	7.76.0	8.11.0
L	CVE-2024-9681: HSTS subdomain overwrites parent cache entry	7.74.0	8.10.1
M	CVE-2024-8096: OCSP stapling bypass with GnuTLS	7.41.0	8.9.1
L	CVE-2024-7264: ASN.1 date parser overread	7.32.0	8.9.0
M	CVE-2024-2398: HTTP/2 push headers memory-leak	7.44.0	8.6.0
L	CVE-2024-2004: Usage of disabled protocol	7.85.0	8.6.0
L	CVE-2023-46219: HSTS long filename clears contents	7.84.0	8.4.0
M	CVE-2023-46218: cookie mixed case PSL bypass	7.46.0	8.4.0
L	CVE-2023-38546: cookie injection with none file	7.9.1	8.3.0
H	CVE-2023-38545: SOCKS5 heap buffer overflow	7.69.0	8.3.0
M	CVE-2023-38039: HTTP headers eat all memory	7.84.0	8.2.1
L	CVE-2023-28322: more POST-after-PUT confusion	7.7	8.0.1
L	CVE-2023-28321: IDN wildcard match	7.12.0	8.0.1
L	CVE-2023-28320: siglongjmp race condition	7.9.8	8.0.1
M	CVE-2023-28319: UAF in SSH sha256 fingerprint check	7.81.0	8.0.1
L	CVE-2023-27538: SSH connection too eager reuse still	7.16.1	7.88.1
L	CVE-2023-27536: GSS delegation too eager connection reuse	7.22.0	7.88.1
M	CVE-2023-27535: FTP too eager connection reuse	7.13.0	7.88.1
L	CVE-2023-27534: SFTP path ~ resolving discrepancy	7.18.0	7.88.1
L	CVE-2023-27533: TELNET option IAC injection	7.7	7.88.1
M	CVE-2023-23916: HTTP multi-header compression denial of service	7.57.0	7.87.0
L	CVE-2023-23915: HSTS amnesia with --parallel	7.77.0	7.87.0
L	CVE-2023-23914: HSTS ignored on multiple requests	7.77.0	7.87.0

Further details

CVE data for 7.87.0 provided as JSON.

Changelog for curl 7.87.0

See vulnerability summary for the previous release: 7.86.0 or the subsequent release: 7.88.0