24 Security Vulnerabilities Patched in curl Used Across 30 Billion Installations

The curl project released curl 8.23.0 on October 14, 2026, announcing 24 security fixes affecting the widely used data transfer tool and its underlying library, libcurl.

The vulnerabilities include credential leaks, authentication errors, command injection, and flaws that can disrupt applications. The release also removes SMB and SMBS protocol support, making compatibility checks important before deployment.

According to security firm AISLE, it discovered 18 of the vulnerabilities announced with this release, representing 75 percent of the total.

Its dedicated audit produced 24 CVEs across two releases, with six addressed in curl 8.22.0 and another eighteen associated with 8.23.0. Those figures describe AISLE’s audit findings, not the complete security count for either release.

curl Security Vulnerabilities

One notable flaw, CVE-2026-86414, allows an HTTP proxy to trick libcurl into handing over credentials intended for the destination server.

During a CONNECT tunnel request, the proxy can return a 401 response with a WWW-Authenticate header instead of the expected proxy authentication response.

This can expose a Basic authentication password or a Negotiate/Kerberos ticket. The issue affects versions 7.10.8 through 8.22.0.

Another vulnerability, CVE-2026-94266, can expose passwords through CURLINFO_EFFECTIVE_URL when curl obtains credentials from a .netrc file. The command-line tool can reveal the same information through its url_effective output variable.

Applications that record these returned URLs could therefore place credentials in logs. Versions 7.62.0 through 8.22.0 are affected.

These findings extend a recurring security concern around credential handling. Cybersecurity News previously covered a curl password leak involving redirects and .netrc files, where credentials could reach an unintended host under specific conditions.

The official advisory for CVE-2026-87864 explains an IMAP command injection flaw involving message uploads and CURLOPT_CRLF. Curl advertised the original message size but sent additional bytes after converting line endings.

A mail server could interpret those extra bytes as commands within the authenticated session. This concerns IMAP commands, not operating system shell commands.

Importantly, this flaw was already fixed in curl 8.22.0, although its advisory was published on October 14. It affects versions 7.30.0 through 8.21.0 and carries a low severity rating. Avoiding CURLOPT_CRLF with IMAP is the documented workaround. Recently, cURL patched a 25-Year-Old Vulnerability with version 8.21.0.

Other AISLE findings involve stale AWS signing headers, credentials crossing redirect boundaries, client certificate mix-ups, damaged cookie storage, and incorrect HSTS cache handling. Additional issues can cause an endless loop or exhaust the process stack. These failures often emerge when settings or connection state persist after the destination or identity changes.

Administrators should upgrade affected curl and libcurl installations to 8.23.0 or apply the relevant patches. Check applications that bundle libcurl, since updating the standalone tool may leave embedded copies unchanged.

Review the settings for proxy authentication, credential logging, and IMAP uploads while planning deployment. Before rollout, check the release announcement for any compatibility changes.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post 24 Security Vulnerabilities Patched in curl Used Across 30 Billion Installations appeared first on Cyber Security News.