VulnerabilityPublished 25 Jun 2026

25-Year-Old Vulnerability Patched in Curl

Source SecurityWeek

Mentioned vulnerabilities

Severity

Low

Rated by Threat Radar

Data as of 26 Jun 2026, 02:22 UTC

What to do

AI-suggested

A patch is available in the latest curl release that addresses these vulnerabilities. Users and developers should update libcurl to the newest version to mitigate these issues. Since the curl project has released an official fix, applying this update is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.

Description

The latest version of the open source data transfer tool resolves 18 medium and low-severity vulnerabilities. The post 25-Year-Old Vulnerability Patched in Curl appeared first on SecurityWeek .

Impact

The vulnerabilities could allow an attacker to bypass authentication via mTLS connection reuse, cause memory corruption issues such as double-free and use-after-free, and potentially cause improper host validation. These flaws affect libcurl applications and could undermine the security of data transfers relying on libcurl. However, there are no known exploits in the wild, and the curl command-line tool is not affected by the mTLS connection reuse issue.

Summary

The curl project released an update fixing 18 vulnerabilities, including one introduced in version 7.7 from 2001 (CVE-2026-8932), which allows libcurl to reuse an existing connection even after client certificate or private key settings change, potentially enabling authentication bypass. Other fixed issues include credential confusion (CVE-2026-8926), double-free (CVE-2026-8925), use-after-free (CVE-2026-9080, CVE-2026-10536), and improper host validation (CVE-2026-9547). These vulnerabilities affect libcurl applications but not the curl command-line tool. The vulnerabilities were discovered through community efforts and AI-assisted analysis. Despite the widespread use of curl across billions of devices, no in-the-wild exploitation has been reported.

References

securityweek.com/25-year-old-vulnerability-patched-in-curl/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 25 Jun 2026, 09:46 UTC

References

Community reviews

Related threats