curl / Docs / Vulnerability table / 8.22.0 vulnerabilities

Vulnerabilities in curl 8.22.0

curl version 8.22.0 was released on September 2 2026

It has the following 21 published security problems.

S	Flaw	First	Last
L	CVE-2026-107929: local interface connection reuse mixup	8.9.0	8.22.0
L	CVE-2026-107928: info leak uploading over WebSockets with GnuTLS	7.86.0	8.22.0
L	CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL	7.62.0	8.22.0
L	CVE-2026-94265: Authorization: Negotiate sent to foreign origin	8.21.0	8.22.0
L	CVE-2026-92386: server-set cookie aborts cookie jar load	8.7.0	8.22.0
L	CVE-2026-92387: never-ending loop via server response omission	8.10.0	8.22.0
L	CVE-2026-92388: FTP wildcard write callback mixup	7.21.0	8.22.0
L	CVE-2026-92389: TFTP direction confusion	7.15.0	8.22.0
L	CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints	7.20.0	8.22.0
L	CVE-2026-92391: curl_mime_free stack overflow by recursion	7.56.0	8.22.0
H	CVE-2026-92392: HTTP/2 upload Use-After-Free	8.12.0	8.22.0
L	CVE-2026-86410: redirect to SFTP or SCP bypasses host verification	7.81.0	8.22.0
L	CVE-2026-86412: server-set cookie erases cookie jar	8.18.0	8.22.0
L	CVE-2026-86413: Negotiate credentials sent to redirected origin	8.21.0	8.22.0
L	CVE-2026-86414: leaking host credentials to HTTP proxy	7.10.8	8.22.0
L	CVE-2026-86415: auto client cert connection reuse mixup	8.21.0	8.22.0
L	CVE-2026-87861: cross-origin reuse of a Negotiate connection	8.21.0	8.22.0
L	CVE-2026-87862: HSTS cache import drops longer-lived child	8.11.0	8.22.0
L	CVE-2026-87863: HSTS response erases persisted entries	8.2.0	8.22.0
L	CVE-2026-87865: knownhost callback mismatches key as missing	7.69.1	8.22.0
L	CVE-2026-87866: wolfSSL public-key pinning bypass	7.43.0	8.22.0

Further details

CVE data for 8.22.0 provided as JSON.