curl / Docs / Vulnerability table / 8.21.0 vulnerabilities

Vulnerabilities in curl 8.21.0

curl version 8.21.0 was released on June 24 2026

It has the following 9 published security problems.

S	Flaw	First	Last
L	CVE-2026-82209: domain-scoped PSL domain cookie	7.46.0	8.21.0
L	CVE-2026-82208: wolfSSL CA-cache hit overrides callback	8.9.1	8.21.0
L	CVE-2026-80255: secure cookie attribute bypass with tab	8.13.0	8.21.0
L	CVE-2026-80231: native CA store conn reuse	7.71.0	8.21.0
L	CVE-2026-80230: OpenSSL pinning bypass	7.45.0	8.21.0
L	CVE-2026-80229: OpenSSL provider use-after-free	8.14.0	8.21.0
M	CVE-2026-19931: Negotiate ambient user conn reuse	7.64.1	8.21.0
L	CVE-2026-18924: HTTP/2 server push UAF	7.44.0	8.21.0
L	CVE-2026-13608: OpenLDAP SASL authentication bypass	7.82.0	8.21.0

Further details

CVE data for 8.21.0 provided as JSON.