IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.1Hoch

CVE-2026-107928info leak uploading over WebSockets with GnuTLS

curl curl Veröffentlicht: (vor 13 Tagen)

Beschreibung

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.

Schwachstellentyp (CWE): CWE-126

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
curl curl 8.22.0 – ≤ 8.22.0, 8.21.0 – ≤ 8.21.0, 8.20.0 – ≤ 8.20.0, 8.19.0 – ≤ 8.19.0, 8.18.0 – ≤ 8.18.0, 8.17.0 – ≤ 8.17.0, 8.16.0 – ≤ 8.16.0, 8.15.0 – ≤ 8.15.0, 8.14.1 – ≤ 8.14.1, 8.14.0 – ≤ 8.14.0, 8.13.0 – ≤ 8.13.0, 8.12.1 – ≤ 8.12.1, 8.12.0 – ≤ 8.12.0, 8.11.1 – ≤ 8.11.1, 8.11.0 – ≤ 8.11.0, 8.10.1 – ≤ 8.10.1, 8.10.0 – ≤ 8.10.0, 8.9.1 – ≤ 8.9.1, 8.9.0 – ≤ 8.9.0, 8.8.0 – ≤ 8.8.0, 8.7.1 – ≤ 8.7.1, 8.7.0 – ≤ 8.7.0, 8.6.0 – ≤ 8.6.0, 8.5.0 – ≤ 8.5.0, 8.4.0 – ≤ 8.4.0, 8.3.0 – ≤ 8.3.0, 8.2.1 – ≤ 8.2.1, 8.2.0 – ≤ 8.2.0, 8.1.2 – ≤ 8.1.2, 8.1.1 – ≤ 8.1.1, 8.1.0 – ≤ 8.1.0, 8.0.1 – ≤ 8.0.1, 8.0.0 – ≤ 8.0.0, 7.88.

Referenzen und Patches

Neue CVEs im selben Produkt — curl / libcurl

8.1Hoch
CVE-2026-107929

local interface connection reuse mixup

curl curl

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…

7.5Hoch
CVE-2026-94266

password leak in CURLINFO_EFFECTIVE_URL

curl curl

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

9.1Kritisch
CVE-2026-94265

Authorization: Negotiate sent to foreign origin

curl curl

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…

7.5Hoch
CVE-2026-92391

curl_mime_free stack overflow by recursion

curl curl

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…

1.2%EPSS
7.5Hoch
CVE-2026-92390

-J no-clobber guarantee bypassed with 103 early hints

curl curl

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…

8.1Hoch
CVE-2026-92389

TFTP direction confusion

curl curl

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that fo…