curl / Docs / Vulnerability table / 8.18.0 vulnerabilities

Vulnerabilities in curl 8.18.0

Related:
Audits
Changelog
curl CVEs
Vulnerability Disclosure
Vulnerabilities Table

curl version 8.18.0 was released on January 7 2026

It has the following 12 published security problems.

Flaw	From version	To and including
cross-proxy Digest auth state leak	7.12.0	8.19.0
OCSP stapling bypass with Apple SecTrust	8.17.0	8.19.0
netrc credential leak with reused proxy connection	7.14.0	8.19.0
stale custom cookie host causes cookie leak	7.71.0	8.19.0
proxy credentials leak over redirect-to proxy	7.14.1	8.19.0
wrong reuse of SMB connection	7.40.0	8.19.0
wrong reuse of HTTP Negotiate connection	7.10.6	8.19.0
connection reuse ignores TLS requirement	7.20.0	8.19.0
use after free in SMB connection reuse	8.13.0	8.18.0
wrong proxy connection reuse with credentials	7.7	8.18.0
token leak with redirect and netrc	7.33.0	8.18.0
bad reuse of HTTP Negotiate connection	7.10.6	8.18.0

Further details

CVE data for 8.18.0 provided as JSON.

Changelog for curl 8.18.0

See vulnerability summary for the previous release: 8.17.0 or the subsequent release: 8.19.0