cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

curl Update Patches 18 Vulnerabilities, Including 25-Year-Old Potential Authentication Bypass

· Original article ↗

Summary

A curl update fixes 18 vulnerabilities, including CVE-2026-8932, a 25-year-old flaw that could allow authentication bypass in libcurl applications. No successful in-the-wild exploitation has been publicly reported.

Key points

  • The update fixes 18 vulnerabilities: four medium-severity and 14 low-severity.
  • CVE-2026-8932, introduced in curl 7.7 in 2001, could allow authentication bypass when libcurl reuses a connection after client-certificate or private-key settings change.
  • CVE-2026-8932 affects libcurl applications, not the curl command-line tool.
  • Other identified flaws include credential confusion, double-free, use-after-free, and improper host validation.
  • Aisle says its AI platform identified multiple curl and libcurl weaknesses; six received CVEs this year.
  • The article reports no public reports of successful in-the-wild exploitation of curl security defects.

Article Details

Vulnerability Types
  • mTLS connection reuse that could lead to authentication bypass
  • Credential confusion
  • Double-free
  • Use-after-free
  • Improper host validation
Severity
The release fixes four medium- and 14 low-severity vulnerabilities; the article does not specify the severity of CVE-2026-8932.
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-10536The other identified flaws include credential confusion (CVE-2026-8926), double-free (CVE-2026-8925), use-after-free (CVE-2026-9080 and CVE-2026-10536), and improper host validation (CVE-2026-9547).CVE-2026-8925The other identified flaws include credential confusion (CVE-2026-8926), double-free (CVE-2026-8925), use-after-free (CVE-2026-9080 and CVE-2026-10536), and improper host validation (CVE-2026-9547).CVE-2026-8926The other identified flaws include credential confusion (CVE-2026-8926), double-free (CVE-2026-8925), use-after-free (CVE-2026-9080 and CVE-2026-10536), and improper host validation (CVE-2026-9547).CVE-2026-8932Tracked as CVE-2026-8932, it is described as an mTLS connection reuse and could lead to authentication bypass.CVE-2026-9080The other identified flaws include credential confusion (CVE-2026-8926), double-free (CVE-2026-8925), use-after-free (CVE-2026-9080 and CVE-2026-10536), and improper host validation (CVE-2026-9547).CVE-2026-9547The other identified flaws include credential confusion (CVE-2026-8926), double-free (CVE-2026-8925), use-after-free (CVE-2026-9080 and CVE-2026-10536), and improper host validation (CVE-2026-9547).

Vendors

AisleThe CVE exists because “libcurl could reuse an existing connection even after client certificate or private key settings had changed,” vulnerability management firm Aisle says.AnthropicThe flaws, four medium and 14 low-severity, were discovered as part of a community effort after Anthropic’s Mythos discovered a single curl bug in early May.

Products

curlThe open source data transfer tool and library curl has been updated this week with patches for 18 vulnerabilities, including one introduced 25 years ago.libcurlIt affects libcurl applications and not the curl command-line tool.MythosThe flaws, four medium and 14 low-severity, were discovered as part of a community effort after Anthropic’s Mythos discovered a single curl bug in early May.

Related Articles