diff --git a/bindings/go/go.mod b/bindings/go/go.mod index 55fda5d4452..d436cfbe856 100644 --- a/bindings/go/go.mod +++ b/bindings/go/go.mod @@ -1,11 +1,11 @@ module osv.dev/bindings/go -go 1.27.0 +go 1.27.1 require ( github.com/google/go-cmp v0.7.0 - github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec - golang.org/x/sync v0.22.0 + github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3 + golang.org/x/sync v0.23.0 google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa google.golang.org/grpc v1.83.2 google.golang.org/protobuf v1.36.12 diff --git a/bindings/go/go.sum b/bindings/go/go.sum index 0a469475587..09b0c9cedb8 100644 --- a/bindings/go/go.sum +++ b/bindings/go/go.sum @@ -10,8 +10,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec h1:A92d74F0MP8hOiPXRnUnuWaluaf3G3sGJfMEcjkZfjA= -github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec/go.mod h1:IrUa4QzZUi03J3WXDzZYXVawYipHownNfqqZrqeGXfg= +github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3 h1:mNqW4tPTIPcx3KL5qZCByAHiTwGcwD/eCEfKOEvLA4g= +github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3/go.mod h1:aW9XJyUJfg0r+HogMGMagTt4hF6ibBkH/FZenG/KiyE= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= @@ -26,8 +26,8 @@ go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/ go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= diff --git a/go/cmd/tools/reimport-tui/go.mod b/go/cmd/tools/reimport-tui/go.mod index 938960fd5e4..3d74e69896c 100644 --- a/go/cmd/tools/reimport-tui/go.mod +++ b/go/cmd/tools/reimport-tui/go.mod @@ -1,6 +1,6 @@ module github.com/google/osv.dev/go/cmd/tools/reimport-tui -go 1.27.0 +go 1.27.1 replace github.com/google/osv.dev/go => ../../../ @@ -52,7 +52,7 @@ require ( github.com/lucasb-eyer/go-colorful v1.4.1 // indirect github.com/mattn/go-runewidth v0.0.27 // indirect github.com/muesli/cancelreader v0.2.2 // indirect - github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec // indirect + github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3 // indirect github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect github.com/redis/go-redis/v9 v9.22.0 // indirect github.com/rivo/uniseg v0.4.7 // indirect @@ -79,12 +79,12 @@ require ( go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect golang.org/x/crypto v0.56.0 // indirect golang.org/x/net v0.58.0 // indirect - golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.22.0 // indirect + golang.org/x/oauth2 v0.37.0 // indirect + golang.org/x/sync v0.23.0 // indirect golang.org/x/sys v0.47.0 // indirect golang.org/x/text v0.41.0 // indirect golang.org/x/time v0.15.0 // indirect - google.golang.org/api v0.294.0 // indirect + google.golang.org/api v0.297.0 // indirect google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect diff --git a/go/cmd/tools/reimport-tui/go.sum b/go/cmd/tools/reimport-tui/go.sum index edf53cc695f..77ab4722bde 100644 --- a/go/cmd/tools/reimport-tui/go.sum +++ b/go/cmd/tools/reimport-tui/go.sum @@ -149,8 +149,8 @@ github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhV github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8= github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA= github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo= -github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec h1:A92d74F0MP8hOiPXRnUnuWaluaf3G3sGJfMEcjkZfjA= -github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec/go.mod h1:IrUa4QzZUi03J3WXDzZYXVawYipHownNfqqZrqeGXfg= +github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3 h1:mNqW4tPTIPcx3KL5qZCByAHiTwGcwD/eCEfKOEvLA4g= +github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3/go.mod h1:aW9XJyUJfg0r+HogMGMagTt4hF6ibBkH/FZenG/KiyE= github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo= github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= @@ -240,13 +240,13 @@ golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= +golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= +golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -267,8 +267,8 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.294.0 h1:8gASjJxdtcIieB3OqbkLcF0FfbXVNqKtU5iozD1ssvA= -google.golang.org/api v0.294.0/go.mod h1:02qB8+Ox1ZFzcaKFMguy1nQLJmSIyvV6Ff4txJEXtl4= +google.golang.org/api v0.297.0 h1:WktxTsnnx0yZNnsR6j0q6hR21RnnK81FHTOPy/ux4OE= +google.golang.org/api v0.297.0/go.mod h1:S4m8x0M6OkQpkOzGk1y9JG2sm4fFQrMh6dxzjCTszhE= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= diff --git a/go/go.mod b/go/go.mod index 1adebd8ba12..a1ca7be39ca 100644 --- a/go/go.mod +++ b/go/go.mod @@ -1,6 +1,6 @@ module github.com/google/osv.dev/go -go 1.27.0 +go 1.27.1 replace osv.dev/bindings/go => ../bindings/go @@ -21,7 +21,7 @@ require ( github.com/klauspost/compress v1.19.2 github.com/microcosm-cc/bluemonday v1.0.27 github.com/nikolalohinski/gonja/v2 v2.9.0 - github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec + github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3 github.com/package-url/packageurl-go v0.1.7 github.com/pandatix/go-cvss v0.6.4 github.com/redis/go-redis/v9 v9.22.0 @@ -35,16 +35,16 @@ require ( go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 go.opentelemetry.io/otel/sdk v1.46.0 go.opentelemetry.io/otel/trace v1.46.0 - golang.org/x/oauth2 v0.36.0 - golang.org/x/sync v0.22.0 + golang.org/x/oauth2 v0.37.0 + golang.org/x/sync v0.23.0 golang.org/x/text v0.41.0 - google.golang.org/api v0.294.0 + google.golang.org/api v0.297.0 google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 google.golang.org/grpc v1.83.2 google.golang.org/protobuf v1.36.12 gopkg.in/dnaeon/go-vcr.v4 v4.0.7 k8s.io/apimachinery v0.37.0 - mvdan.cc/sh/v3 v3.13.1 + mvdan.cc/sh/v3 v3.14.0 osv.dev/bindings/go v0.0.0-20260527044221-c1c72c1b0158 sigs.k8s.io/yaml v1.6.0 ) diff --git a/go/go.sum b/go/go.sum index bcd9cc8d5a1..855918fd3f1 100644 --- a/go/go.sum +++ b/go/go.sum @@ -124,8 +124,8 @@ github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI= -github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow= +github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474= +github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI= github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= @@ -217,8 +217,8 @@ github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8= github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y= github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0= -github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec h1:A92d74F0MP8hOiPXRnUnuWaluaf3G3sGJfMEcjkZfjA= -github.com/ossf/osv-schema/bindings/go v0.0.0-20260806060209-f3f826310aec/go.mod h1:IrUa4QzZUi03J3WXDzZYXVawYipHownNfqqZrqeGXfg= +github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3 h1:mNqW4tPTIPcx3KL5qZCByAHiTwGcwD/eCEfKOEvLA4g= +github.com/ossf/osv-schema/bindings/go v0.0.0-20260902031056-b388a18021a3/go.mod h1:aW9XJyUJfg0r+HogMGMagTt4hF6ibBkH/FZenG/KiyE= github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY= github.com/package-url/packageurl-go v0.1.7/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0= github.com/pandatix/go-cvss v0.6.4 h1:9w2RCO/Q4UTiJyEgpCHRiVc6CfrsFEnkoX+OtATqKio= @@ -235,8 +235,8 @@ github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= -github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= -github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= +github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc= +github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs= github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw= github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w= @@ -334,13 +334,13 @@ golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= +golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= +golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -365,8 +365,8 @@ golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.294.0 h1:8gASjJxdtcIieB3OqbkLcF0FfbXVNqKtU5iozD1ssvA= -google.golang.org/api v0.294.0/go.mod h1:02qB8+Ox1ZFzcaKFMguy1nQLJmSIyvV6Ff4txJEXtl4= +google.golang.org/api v0.297.0 h1:WktxTsnnx0yZNnsR6j0q6hR21RnnK81FHTOPy/ux4OE= +google.golang.org/api v0.297.0/go.mod h1:S4m8x0M6OkQpkOzGk1y9JG2sm4fFQrMh6dxzjCTszhE= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= @@ -409,8 +409,8 @@ honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= k8s.io/apimachinery v0.37.0 h1:Np2AbDtf8x6RDHiD8T9LbKJ9gaegeVNa8yNm5FuGKm0= k8s.io/apimachinery v0.37.0/go.mod h1:RN3nhprFSCxOi5Selxd7oMTXOe/c+ZbcE7Im+TS2zkE= -mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk= -mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0= +mvdan.cc/sh/v3 v3.14.0 h1:wsPjcfrSXLJomdxwhVZqZ5j5Cue68l549Aj/DCqzbpc= +mvdan.cc/sh/v3 v3.14.0/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg= sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= diff --git a/go/internal/sharding/sharding.go b/go/internal/sharding/sharding.go index 35ddc9c3c0d..a6d0658296f 100644 --- a/go/internal/sharding/sharding.go +++ b/go/internal/sharding/sharding.go @@ -48,7 +48,10 @@ func ExpandBreakdownPrefixes(str string) []string { var prefixes []string printer := syntax.NewPrinter() - for _, word := range expand.Braces(w) { + for word, err := range expand.BracesSeq(nil, w) { + if err != nil { + break + } var buf bytes.Buffer _ = printer.Print(&buf, word) for p := range strings.SplitSeq(buf.String(), ",") { diff --git a/tools/apitester/__snapshots__/cassette_TestCommand.snap b/tools/apitester/__snapshots__/cassette_TestCommand.snap index 90dc647f07b..cf1bf80b1bb 100755 --- a/tools/apitester/__snapshots__/cassette_TestCommand.snap +++ b/tools/apitester/__snapshots__/cassette_TestCommand.snap @@ -4154,6 +4154,10 @@ "id": "DEBIAN-CVE-2026-6732", "modified": "" }, + { + "id": "DEBIAN-CVE-2026-74860", + "modified": "" + }, { "id": "DEBIAN-CVE-2026-86137", "modified": "" @@ -8003,6 +8007,10 @@ { "id": "PYSEC-2026-3699", "modified": "" + }, + { + "id": "PYSEC-2026-3923", + "modified": "" } ] }, @@ -9259,6 +9267,10 @@ { "id": "PYSEC-2026-3699", "modified": "" + }, + { + "id": "PYSEC-2026-3923", + "modified": "" } ] }, diff --git a/tools/apitester/__snapshots__/cassette_single_query.snap b/tools/apitester/__snapshots__/cassette_single_query.snap index 4dd362d9281..7048171f700 100755 --- a/tools/apitester/__snapshots__/cassette_single_query.snap +++ b/tools/apitester/__snapshots__/cassette_single_query.snap @@ -3298,2094 +3298,65 @@ ] }, { - "id": "CVE-2024-11053", - "summary": "netrc and redirect credential leak", - "details": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password.", - "aliases": ["CURL-CVE-2024-11053"], + "id": "CVE-2024-7264", + "summary": "ASN.1 date parser overread", + "details": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.", + "aliases": ["CURL-CVE-2024-7264"], "modified": "", - "published": "2024-12-11T07:34:29.539Z", + "published": "2024-07-31T08:08:14.585Z", "related": [ "ALSA-2025:1671", "ALSA-2025:1673", - "SUSE-SU-2024:4284-1", - "SUSE-SU-2024:4284-2", - "SUSE-SU-2024:4287-1", - "SUSE-SU-2024:4288-1", - "SUSE-SU-2024:4359-1", - "SUSE-SU-2025:20106-1", - "SUSE-SU-2025:20239-1", - "openSUSE-SU-2024:14575-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2024/12/11/1" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-11053.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-11053.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/2829063" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11053.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11053" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20250124-0012/" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20250131-0003/" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20250131-0004/" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "3266b35bbe21c68dea0dc7ccd991eb028e6d360c" - }, - { - "fixed": "75a2079d5c28debb2eaa848ca9430f1fe0d7844c" - } - ], - "database_specific": "" - } - ], - "versions": 36, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N" - } - ] - }, - { - "id": "CVE-2024-2004", - "summary": "Usage of disabled protocol", - "details": "When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.", - "aliases": ["CURL-CVE-2024-2004"], - "modified": "", - "published": "2024-03-27T07:54:27.157Z", - "related": [ - "SUSE-SU-2024:1120-1", - "SUSE-SU-2024:1150-1", - "SUSE-SU-2024:1151-1", - "SUSE-SU-2024:1151-2", - "SUSE-SU-2024:1151-3", - "SUSE-SU-2025:20029-1", - "openSUSE-SU-2024:13805-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2024/Jul/18" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2024/Jul/19" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2024/Jul/20" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2024/03/27/1" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-2004.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-2004.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/2384833" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/" - }, - { - "type": "WEB", - "url": "https://support.apple.com/kb/HT214118" - }, - { - "type": "WEB", - "url": "https://support.apple.com/kb/HT214119" - }, - { - "type": "WEB", - "url": "https://support.apple.com/kb/HT214120" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2004.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2004" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20240524-0006/" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "93d092867f0f2c78571983040ef75e078ee1a4c4" - }, - { - "fixed": "72cf468d459d29e5366e416c014faaaf281dfa2d" - } - ], - "database_specific": "" - } - ], - "versions": 16, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" - } - ] - }, - { - "id": "CVE-2024-2398", - "summary": "HTTP/2 push headers memory-leak", - "details": "When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.", - "aliases": ["CURL-CVE-2024-2398"], - "modified": "", - "published": "2024-03-27T07:55:48.524Z", - "related": [ - "ALSA-2024:5529", - "ALSA-2024:5654", - "SUSE-SU-2024:1120-1", - "SUSE-SU-2024:1150-1", - "SUSE-SU-2024:1151-1", - "SUSE-SU-2024:1151-2", - "SUSE-SU-2024:1151-3", + "SUSE-SU-2024:2784-1", + "SUSE-SU-2024:2930-1", + "SUSE-SU-2024:2938-1", + "SUSE-SU-2024:3080-1", + "SUSE-SU-2024:3080-2", + "SUSE-SU-2024:3202-1", "SUSE-SU-2025:20029-1", - "openSUSE-SU-2024:13805-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2024/Jul/18" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2024/Jul/19" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2024/Jul/20" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2024/03/27/3" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-2398.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-2398.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/2402845" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/" - }, - { - "type": "WEB", - "url": "https://support.apple.com/kb/HT214118" - }, - { - "type": "WEB", - "url": "https://support.apple.com/kb/HT214119" - }, - { - "type": "WEB", - "url": "https://support.apple.com/kb/HT214120" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2398.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2398" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20240503-0009/" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "1a7f66a3de2625d10f65415e6eb3e56067dc0555" - }, - { - "fixed": "72cf468d459d29e5366e416c014faaaf281dfa2d" - } - ], - "database_specific": "" - } - ], - "versions": 77, - "database_specific": "" - } + "openSUSE-SU-2024:14261-1" ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" - } - ] - }, - { - "id": "CVE-2024-2466", - "summary": "TLS certificate check bypass with mbedTLS", - "details": "libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).", - "aliases": ["CURL-CVE-2024-2466"], - "modified": "", - "published": "2024-03-27T07:58:24.520Z", - "related": ["SUSE-SU-2025:20029-1", "openSUSE-SU-2024:13805-1"], "database_specific": "", "references": [ { "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2024/Jul/18" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2024/Jul/19" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2024/Jul/20" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2024/03/27/4" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-2466.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-2466.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/2416725" - }, - { - "type": "WEB", - "url": "https://support.apple.com/kb/HT214118" - }, - { - "type": "WEB", - "url": "https://support.apple.com/kb/HT214119" - }, - { - "type": "WEB", - "url": "https://support.apple.com/kb/HT214120" - }, - { - "type": "WEB", - "url": "https://www.vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2466.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2466" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20240503-0010/" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "7161cb17c01dcff1dc5bf89a18437d9d729f1ecd" - }, - { - "fixed": "72cf468d459d29e5366e416c014faaaf281dfa2d" - } - ], - "database_specific": "" - } - ], - "versions": 2, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" - } - ] - }, - { - "id": "CVE-2024-7264", - "summary": "ASN.1 date parser overread", - "details": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.", - "aliases": ["CURL-CVE-2024-7264"], - "modified": "", - "published": "2024-07-31T08:08:14.585Z", - "related": [ - "ALSA-2025:1671", - "ALSA-2025:1673", - "SUSE-SU-2024:2784-1", - "SUSE-SU-2024:2930-1", - "SUSE-SU-2024:2938-1", - "SUSE-SU-2024:3080-1", - "SUSE-SU-2024:3080-2", - "SUSE-SU-2024:3202-1", - "SUSE-SU-2025:20029-1", - "openSUSE-SU-2024:14261-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2024/07/31/1" + "url": "http://www.openwall.com/lists/oss-security/2024/07/31/1" }, { "type": "WEB", "url": "https://curl.se/docs/CVE-2024-7264.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-7264.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/2629968" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7264.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7264" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20240828-0008/" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20241025-0006/" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20241025-0010/" - }, - { - "type": "FIX", - "url": "https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "70812c2f32fc5734bcbbe572b9f61c380433ad6a" - }, - { - "fixed": "83bedbd730d62b83744cc26fa0433d3f6e2e4cd6" - }, - { - "fixed": "27959ecce75cdb2809c0bdb3286e60e08fadb519" - } - ], - "database_specific": "" - } - ], - "versions": 189, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" - } - ] - }, - { - "id": "CVE-2024-8096", - "summary": "OCSP stapling bypass with GnuTLS", - "details": "When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.", - "aliases": ["CURL-CVE-2024-8096"], - "modified": "", - "published": "2024-09-11T10:03:59.489Z", - "related": [ - "SUSE-SU-2024:3202-1", - "SUSE-SU-2024:3203-1", - "SUSE-SU-2024:3204-1", - "SUSE-SU-2024:3211-1", - "SUSE-SU-2025:20239-1", - "openSUSE-SU-2024:14333-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2024/09/11/1" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-8096.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-8096.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/2669852" - }, - { - "type": "WEB", - "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8096.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8096" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20241011-0005/" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "ff837422ee4ec7d6aea7750a40e30cba29db93e8" - }, - { - "fixed": "a3bd1dda12ec79cd63e0d81df4ec4b1fbbbcfa1b" - } - ], - "database_specific": "" - } - ], - "versions": 85, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" - } - ] - }, - { - "id": "CVE-2024-9681", - "summary": "HSTS subdomain overwrites parent cache entry", - "details": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended.", - "aliases": ["CURL-CVE-2024-9681"], - "modified": "", - "published": "2024-11-06T07:47:20.162Z", - "related": [ - "SUSE-SU-2024:3925-1", - "SUSE-SU-2024:3926-1", - "SUSE-SU-2024:3927-1", - "SUSE-SU-2024:3927-2", - "SUSE-SU-2025:20083-1", - "SUSE-SU-2025:20239-1", - "openSUSE-SU-2024:14476-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2025/Apr/10" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2025/Apr/11" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2025/Apr/12" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2025/Apr/13" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2025/Apr/4" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2025/Apr/5" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2025/Apr/8" - }, - { - "type": "WEB", - "url": "http://seclists.org/fulldisclosure/2025/Apr/9" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2024/11/06/2" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-9681.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2024-9681.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/2764830" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9681.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9681" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20241213-0006/" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "e052859759b34d0e05ce0f17244873e5cd7b457b" - }, - { - "fixed": "b1ef0e1a01c0bb6ee5367bd9c186a603bde3615a" - } - ], - "database_specific": "" - } - ], - "versions": 37, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" - } - ] - }, - { - "id": "CVE-2025-0167", - "summary": "netrc and default credential leak", - "details": "When asked to use a `.netrc` file for credentials **and** to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has a `default` entry that\nomits both login and password. A rare circumstance.", - "aliases": ["CURL-CVE-2025-0167"], - "modified": "", - "published": "2025-02-05T09:15:06.891Z", - "related": [ - "SUSE-SU-2025:0369-1", - "SUSE-SU-2025:0370-1", - "SUSE-SU-2025:0371-1", - "SUSE-SU-2025:0372-1", - "SUSE-SU-2025:20144-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-0167.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-0167.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/2917232" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0167.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0167" - }, - { - "type": "ADVISORY", - "url": "https://security.netapp.com/advisory/ntap-20250306-0008/" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "3266b35bbe21c68dea0dc7ccd991eb028e6d360c" - }, - { - "fixed": "34cf9d54a46598c44938aa7598820484d7af7133" - } - ], - "database_specific": "" - } - ], - "versions": 37, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N" - } - ] - }, - { - "id": "CVE-2025-10966", - "summary": "missing SFTP host verification with wolfSSH", - "details": "curl's code for managing SSH connections when SFTP was done using the wolfSSH\npowered backend was flawed and missed host verification mechanisms.\n\nThis prevents curl from detecting MITM attackers and more.", - "aliases": ["CURL-CVE-2025-10966"], - "modified": "", - "published": "2025-11-07T07:26:30.351Z", - "related": ["openSUSE-SU-2025:15757-1"], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/11/05/2" - }, - { - "type": "WEB", - "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-10966.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-10966.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3355218" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10966.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10966" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "b8d1366852fd0034374c5de1e4968c7a224f77cc" - }, - { - "fixed": "400fffa90f30c7a2dc762fa33009d24851bd2016" - } - ], - "database_specific": "" - } - ], - "versions": 53, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ] - }, - { - "id": "CVE-2025-14017", - "summary": "broken TLS options for threaded LDAPS", - "details": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.", - "aliases": ["CURL-CVE-2025-14017"], - "modified": "", - "published": "2026-01-08T10:07:05.554Z", - "related": [ - "SUSE-SU-2026:0077-1", - "SUSE-SU-2026:0078-1", - "SUSE-SU-2026:0119-1", - "SUSE-SU-2026:0221-1", - "SUSE-SU-2026:0508-1", - "SUSE-SU-2026:20082-1", - "SUSE-SU-2026:20110-1", - "SUSE-SU-2026:20347-1", - "SUSE-SU-2026:20358-1", - "openSUSE-SU-2026:10017-1", - "openSUSE-SU-2026:20031-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/01/07/3" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-14017.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-14017.json" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14017.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "b238e0b1b4e8f3e5c4e9c0d7d8c565e3776b0999" - }, - { - "fixed": "2eebc58c4b8d68c98c8344381a9f6df4cca838fd" - } - ], - "database_specific": "" - } - ], - "versions": 142, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" - } - ] - }, - { - "id": "CVE-2025-14524", - "summary": "bearer token leak on cross-protocol redirect", - "details": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.", - "aliases": ["CURL-CVE-2025-14524"], - "modified": "", - "published": "2026-01-08T10:07:25.655Z", - "related": [ - "SUSE-SU-2026:0050-1", - "SUSE-SU-2026:0051-1", - "SUSE-SU-2026:0052-1", - "SUSE-SU-2026:0066-1", - "SUSE-SU-2026:0508-1", - "SUSE-SU-2026:20042-1", - "SUSE-SU-2026:20062-1", - "SUSE-SU-2026:20082-1", - "SUSE-SU-2026:20110-1", - "openSUSE-SU-2026:10017-1", - "openSUSE-SU-2026:20031-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/01/07/4" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-14524.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-14524.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3459417" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14524.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14524" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "f77e89c5d20db09eaebf378ec036a7e796932810" - }, - { - "fixed": "2eebc58c4b8d68c98c8344381a9f6df4cca838fd" - } - ], - "database_specific": "" - } - ], - "versions": 106, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" - } - ] - }, - { - "id": "CVE-2025-14819", - "summary": "OpenSSL partial chain store policy bypass", - "details": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user's wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.", - "aliases": ["CURL-CVE-2025-14819"], - "modified": "", - "published": "2026-01-08T10:07:54.408Z", - "related": [ - "SUSE-SU-2026:0050-1", - "SUSE-SU-2026:0051-1", - "SUSE-SU-2026:0052-1", - "SUSE-SU-2026:0066-1", - "SUSE-SU-2026:0508-1", - "SUSE-SU-2026:20042-1", - "SUSE-SU-2026:20062-1", - "SUSE-SU-2026:20082-1", - "SUSE-SU-2026:20110-1", - "openSUSE-SU-2026:10017-1", - "openSUSE-SU-2026:20031-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/01/07/5" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-14819.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-14819.json" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14819.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14819" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "c12fb3ddaf48e709a7a4deaa55ec485e4df163ee" - }, - { - "fixed": "2eebc58c4b8d68c98c8344381a9f6df4cca838fd" - } - ], - "database_specific": "" - } - ], - "versions": 31, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" - } - ] - }, - { - "id": "CVE-2025-15079", - "summary": "libssh global known_hosts override", - "details": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.", - "aliases": ["CURL-CVE-2025-15079"], - "modified": "", - "published": "2026-01-08T10:08:13.410Z", - "related": [ - "SUSE-SU-2026:0050-1", - "SUSE-SU-2026:0051-1", - "SUSE-SU-2026:0052-1", - "SUSE-SU-2026:0066-1", - "SUSE-SU-2026:0508-1", - "SUSE-SU-2026:20042-1", - "SUSE-SU-2026:20062-1", - "SUSE-SU-2026:20082-1", - "SUSE-SU-2026:20110-1", - "openSUSE-SU-2026:10017-1", - "openSUSE-SU-2026:20031-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/01/07/6" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-15079.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-15079.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3477116" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15079.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15079" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "d6c21c8eec597a925d2b647cff3d58ac69de01a0" - }, - { - "fixed": "2eebc58c4b8d68c98c8344381a9f6df4cca838fd" - } - ], - "database_specific": "" - } - ], - "versions": 70, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" - } - ] - }, - { - "id": "CVE-2025-15224", - "summary": "libssh key passphrase bypass without agent set", - "details": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.", - "aliases": ["CURL-CVE-2025-15224"], - "modified": "", - "published": "2026-01-08T10:08:27.516Z", - "related": [ - "SUSE-SU-2026:0050-1", - "SUSE-SU-2026:0051-1", - "SUSE-SU-2026:0052-1", - "SUSE-SU-2026:0508-1", - "SUSE-SU-2026:20042-1", - "SUSE-SU-2026:20062-1", - "SUSE-SU-2026:20082-1", - "SUSE-SU-2026:20110-1", - "openSUSE-SU-2026:10017-1", - "openSUSE-SU-2026:20031-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/01/07/7" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-15224.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-15224.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3480925" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15224.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15224" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "d6c21c8eec597a925d2b647cff3d58ac69de01a0" - }, - { - "fixed": "2eebc58c4b8d68c98c8344381a9f6df4cca838fd" - } - ], - "database_specific": "" - } - ], - "versions": 70, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" - } - ] - }, - { - "id": "CVE-2025-5025", - "summary": "No QUIC certificate pinning with wolfSSL", - "details": "libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.", - "aliases": ["CURL-CVE-2025-5025"], - "modified": "", - "published": "2025-05-28T06:29:51.915Z", - "related": [ - "SUSE-SU-2025:03198-1", - "SUSE-SU-2025:20675-1", - "openSUSE-SU-2025:15176-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/05/28/5" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-5025.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2025-5025.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3153497" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5025.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5025" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "7161cb17c01dcff1dc5bf89a18437d9d729f1ecd" - }, - { - "fixed": "4dacb79fcdd9364c1083e06f6a011d797a344f47" - } - ], - "database_specific": "" - } - ], - "versions": 14, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" - } - ] - }, - { - "id": "CVE-2026-10536", - "summary": "HTTP/2 stream-dependency tree UAF", - "details": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.", - "aliases": ["CURL-CVE-2026-10536"], - "modified": "", - "published": "2026-07-03T06:11:15.378Z", - "related": [ - "SUSE-SU-2026:22553-1", - "SUSE-SU-2026:22582-1", - "SUSE-SU-2026:22709-1", - "SUSE-SU-2026:22889-1", - "SUSE-SU-2026:2925-1", - "SUSE-SU-2026:2926-1", - "SUSE-SU-2026:3043-1", - "SUSE-SU-2026:3814-1", - "openSUSE-SU-2026:11230-1", - "openSUSE-SU-2026:21272-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-10536.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-10536.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3751697" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10536.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "3027611ca6d4cc5510d2d0fccc3e5a074e09a2fb" - }, - { - "fixed": "68720b4837284335b2d63cb358f8f6ce65f5bc55" - } - ], - "database_specific": "" - } - ], - "versions": 39, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ] - }, - { - "id": "CVE-2026-11856", - "summary": "cross-origin Digest auth state leak", - "details": "Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.", - "aliases": ["CURL-CVE-2026-11856"], - "modified": "", - "published": "2026-07-03T06:13:31.661Z", - "related": ["openSUSE-SU-2026:11230-1"], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-11856.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-11856.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3793260" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11856.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11856" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "bdb5e5a25037a585e0ec6b83d29b25961c6823f8" - }, - { - "fixed": "68720b4837284335b2d63cb358f8f6ce65f5bc55" - } - ], - "database_specific": "" - } - ], - "versions": 179, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ] - }, - { - "id": "CVE-2026-12064", - "summary": "proto-default skips SSH verification", - "details": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", - "aliases": ["CURL-CVE-2026-12064"], - "modified": "", - "published": "2026-07-03T06:13:55.302Z", - "related": [ - "SUSE-SU-2026:22553-1", - "SUSE-SU-2026:22582-1", - "SUSE-SU-2026:22709-1", - "SUSE-SU-2026:22889-1", - "SUSE-SU-2026:2925-1", - "SUSE-SU-2026:2926-1", - "SUSE-SU-2026:3043-1", - "openSUSE-SU-2026:11230-1", - "openSUSE-SU-2026:21272-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-12064.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-12064.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3797526" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12064.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12064" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "801bd5138ce31aa0d906fa4e2eabfc599d74e793" - }, - { - "fixed": "68720b4837284335b2d63cb358f8f6ce65f5bc55" - } - ], - "database_specific": "" - } - ], - "versions": 47, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" - } - ] - }, - { - "id": "CVE-2026-1965", - "summary": "bad reuse of HTTP Negotiate connection", - "details": "libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it just sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl's reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API).", - "aliases": ["CURL-CVE-2026-1965"], - "modified": "", - "published": "2026-03-11T10:08:52.431Z", - "related": [ - "ALSA-2026:55439", - "SUSE-SU-2026:0879-1", - "SUSE-SU-2026:0885-1", - "SUSE-SU-2026:0903-1", - "SUSE-SU-2026:0911-1", - "SUSE-SU-2026:0921-1", - "SUSE-SU-2026:1717-1", - "SUSE-SU-2026:1940-1", - "SUSE-SU-2026:20668-1", - "SUSE-SU-2026:20722-1", - "SUSE-SU-2026:20760-1", - "SUSE-SU-2026:20918-1", - "SUSE-SU-2026:21452-1", - "openSUSE-SU-2026:10371-1", - "openSUSE-SU-2026:20404-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-1965.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-1965.json" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1965.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "bdb5e5a25037a585e0ec6b83d29b25961c6823f8" - }, - { - "fixed": "8c908d2d0a6d32abdedda2c52e90bd56ec76c24d" - } - ], - "database_specific": "" - } - ], - "versions": 171, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" - } - ] - }, - { - "id": "CVE-2026-3783", - "summary": "token leak with redirect and netrc", - "details": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.", - "aliases": ["CURL-CVE-2026-3783"], - "modified": "", - "published": "2026-03-11T10:09:08.746Z", - "related": [ - "ALSA-2026:55439", - "SUSE-SU-2026:0879-1", - "SUSE-SU-2026:0885-1", - "SUSE-SU-2026:0903-1", - "SUSE-SU-2026:0911-1", - "SUSE-SU-2026:0921-1", - "SUSE-SU-2026:20668-1", - "SUSE-SU-2026:20722-1", - "SUSE-SU-2026:20760-1", - "SUSE-SU-2026:20918-1", - "openSUSE-SU-2026:10371-1", - "openSUSE-SU-2026:20404-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/03/11/2" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-3783.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-3783.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3583983" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3783.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "f77e89c5d20db09eaebf378ec036a7e796932810" - }, - { - "fixed": "8c908d2d0a6d32abdedda2c52e90bd56ec76c24d" - } - ], - "database_specific": "" - } - ], - "versions": 107, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" - } - ] - }, - { - "id": "CVE-2026-3784", - "summary": "wrong proxy connection reuse with credentials", - "details": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.", - "aliases": ["CURL-CVE-2026-3784"], - "modified": "", - "published": "2026-03-11T10:09:21.418Z", - "related": [ - "SUSE-SU-2026:0879-1", - "SUSE-SU-2026:0885-1", - "SUSE-SU-2026:0903-1", - "SUSE-SU-2026:0911-1", - "SUSE-SU-2026:0921-1", - "SUSE-SU-2026:20668-1", - "SUSE-SU-2026:20722-1", - "SUSE-SU-2026:20760-1", - "SUSE-SU-2026:20918-1", - "openSUSE-SU-2026:10371-1", - "openSUSE-SU-2026:20404-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/03/11/3" - }, - { - "type": "WEB", - "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-3784.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-3784.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3584903" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3784.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "546572da0457f37c698c02d0a08d90fdfcbeedec" - }, - { - "fixed": "2eebc58c4b8d68c98c8344381a9f6df4cca838fd" - } - ], - "database_specific": "" - } - ], - "versions": 200, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" - } - ] - }, - { - "id": "CVE-2026-4873", - "summary": "connection reuse ignores TLS requirement", - "details": "A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.", - "aliases": ["CURL-CVE-2026-4873"], - "modified": "", - "published": "2026-05-13T08:27:04.538Z", - "related": [ - "SUSE-SU-2026:1717-1", - "SUSE-SU-2026:1940-1", - "SUSE-SU-2026:21452-1", - "SUSE-SU-2026:22146-1", - "SUSE-SU-2026:22156-1", - "SUSE-SU-2026:2703-1", - "SUSE-SU-2026:2925-1", - "openSUSE-SU-2026:10674-1", - "openSUSE-SU-2026:20973-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/04/29/7" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-4873.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-4873.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3621851" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4873.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4873" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "f2f07dad3451d1f63b56d3de0b43160c39d275d7" - }, - { - "fixed": "a05f34973e6c4bb629d018f7cb51487be1c904d8" - } - ], - "database_specific": "" - } - ], - "versions": 133, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ] - }, - { - "id": "CVE-2026-5545", - "summary": "wrong reuse of HTTP Negotiate connection", - "details": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...", - "aliases": ["CURL-CVE-2026-5545"], - "modified": "", - "published": "2026-05-13T08:27:26.065Z", - "related": [ - "SUSE-SU-2026:1717-1", - "SUSE-SU-2026:1940-1", - "SUSE-SU-2026:21452-1", - "SUSE-SU-2026:22146-1", - "SUSE-SU-2026:22156-1", - "SUSE-SU-2026:2703-1", - "SUSE-SU-2026:3798-1", - "openSUSE-SU-2026:10674-1", - "openSUSE-SU-2026:20973-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-5545.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-5545.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3642555" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5545.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5545" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "bdb5e5a25037a585e0ec6b83d29b25961c6823f8" - }, - { - "fixed": "a05f34973e6c4bb629d018f7cb51487be1c904d8" - } - ], - "database_specific": "" - } - ], - "versions": 175, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" - } - ] - }, - { - "id": "CVE-2026-5773", - "summary": "wrong reuse of SMB connection", - "details": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different 'share' than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", - "aliases": ["CURL-CVE-2026-5773"], - "modified": "", - "published": "2026-05-13T08:27:42.342Z", - "related": [ - "SUSE-SU-2026:2703-1", - "SUSE-SU-2026:3798-1", - "openSUSE-SU-2026:10674-1", - "openSUSE-SU-2026:21774-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/04/29/9" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-5773.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-5773.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3650689" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5773.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5773" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "9ce2d7001939b795b45a8ce7700d1a3dcde0475d" - }, - { - "fixed": "a05f34973e6c4bb629d018f7cb51487be1c904d8" - } - ], - "database_specific": "" - } - ], - "versions": 103, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ] - }, - { - "id": "CVE-2026-6253", - "summary": "proxy credentials leak over redirect-to proxy", - "details": "curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n a redirect to a URL using another scheme (say `https://`), accessed using a\n second, different, proxy", - "aliases": ["CURL-CVE-2026-6253"], - "modified": "", - "published": "2026-05-13T08:28:03.004Z", - "related": [ - "SUSE-SU-2026:1717-1", - "SUSE-SU-2026:1940-1", - "SUSE-SU-2026:21452-1", - "SUSE-SU-2026:22146-1", - "SUSE-SU-2026:22156-1", - "SUSE-SU-2026:2703-1", - "SUSE-SU-2026:3798-1", - "openSUSE-SU-2026:10674-1", - "openSUSE-SU-2026:20973-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/04/29/11" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-6253.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-6253.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3669637" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6253.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6253" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "6e1a986e0f35cf36618bd88f42e14ea856b6951b" - }, - { - "fixed": "a05f34973e6c4bb629d018f7cb51487be1c904d8" - } - ], - "database_specific": "" - } - ], - "versions": 160, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ] - }, - { - "id": "CVE-2026-6276", - "summary": "stale custom cookie host causes cookie leak", - "details": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", - "aliases": ["CURL-CVE-2026-6276"], - "modified": "", - "published": "2026-05-13T08:28:19.273Z", - "related": [ - "SUSE-SU-2026:1717-1", - "SUSE-SU-2026:1940-1", - "SUSE-SU-2026:21452-1", - "SUSE-SU-2026:22146-1", - "SUSE-SU-2026:22156-1", - "SUSE-SU-2026:2703-1", - "SUSE-SU-2026:3798-1", - "openSUSE-SU-2026:10674-1", - "openSUSE-SU-2026:20973-1" - ], - "database_specific": "", - "references": [ - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/04/29/13" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-6276.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-6276.json" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/3671818" - }, - { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6276.json" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6276" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "e9db32a09af03f27e86d1251a9e68e9b7486d371" - }, - { - "fixed": "a05f34973e6c4bb629d018f7cb51487be1c904d8" - } - ], - "database_specific": "" - } - ], - "versions": 56, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ] - }, - { - "id": "CVE-2026-6429", - "summary": "netrc credential leak with reused proxy connection", - "details": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.", - "aliases": ["CURL-CVE-2026-6429"], - "modified": "", - "published": "2026-05-13T08:28:36.166Z", - "related": [ - "SUSE-SU-2026:1717-1", - "SUSE-SU-2026:1940-1", - "SUSE-SU-2026:21452-1", - "SUSE-SU-2026:22146-1", - "SUSE-SU-2026:22156-1", - "SUSE-SU-2026:2703-1", - "SUSE-SU-2026:3798-1", - "openSUSE-SU-2026:10674-1", - "openSUSE-SU-2026:20973-1" - ], - "database_specific": "", - "references": [ + }, { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-6429.html" + "url": "https://curl.se/docs/CVE-2024-7264.json" }, { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-6429.json" + "url": "https://hackerone.com/reports/2629968" }, { - "type": "WEB", - "url": "https://hackerone.com/reports/3677759" + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7264.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7264" + }, + { + "type": "ADVISORY", + "url": "https://security.netapp.com/advisory/ntap-20240828-0008/" }, { "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6429.json" + "url": "https://security.netapp.com/advisory/ntap-20241025-0006/" }, { "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6429" + "url": "https://security.netapp.com/advisory/ntap-20241025-0010/" + }, + { + "type": "FIX", + "url": "https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519" } ], "affected": [ @@ -5396,16 +3367,19 @@ "repo": "https://github.com/curl/curl", "events": [ { - "introduced": "55225106b6a0ecface0f129367e533736a874a91" + "introduced": "70812c2f32fc5734bcbbe572b9f61c380433ad6a" + }, + { + "fixed": "541d30346047d973e3e7487d08d24d515a547938" }, { - "fixed": "a05f34973e6c4bb629d018f7cb51487be1c904d8" + "fixed": "27959ecce75cdb2809c0bdb3286e60e08fadb519" } ], "database_specific": "" } ], - "versions": 161, + "versions": 189, "database_specific": "" } ], @@ -5413,191 +3387,87 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" } ] }, { - "id": "CVE-2026-7168", - "summary": "cross-proxy Digest auth state leak", - "details": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.", - "aliases": ["CURL-CVE-2026-7168"], + "id": "CVE-2024-9681", + "summary": "HSTS subdomain overwrites parent cache entry", + "details": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended.", + "aliases": ["CURL-CVE-2024-9681"], "modified": "", - "published": "2026-05-13T08:29:08.900Z", + "published": "2024-11-06T07:47:20.162Z", "related": [ - "SUSE-SU-2026:3798-1", - "SUSE-SU-2026:3814-1", - "openSUSE-SU-2026:21774-1" + "SUSE-SU-2024:3925-1", + "SUSE-SU-2024:3926-1", + "SUSE-SU-2024:3927-1", + "SUSE-SU-2024:3927-2", + "SUSE-SU-2025:20083-1", + "SUSE-SU-2025:20239-1", + "openSUSE-SU-2024:14476-1" ], "database_specific": "", "references": [ { "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2026/04/29/14" + "url": "http://seclists.org/fulldisclosure/2025/Apr/10" }, { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-7168.html" + "url": "http://seclists.org/fulldisclosure/2025/Apr/11" }, { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-7168.json" + "url": "http://seclists.org/fulldisclosure/2025/Apr/12" }, { "type": "WEB", - "url": "https://hackerone.com/reports/3697719" + "url": "http://seclists.org/fulldisclosure/2025/Apr/13" }, { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7168.json" + "type": "WEB", + "url": "http://seclists.org/fulldisclosure/2025/Apr/4" }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7168" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "39626d8cfdd8f858d2fa67ec18204ebc5913d532" - }, - { - "fixed": "a05f34973e6c4bb629d018f7cb51487be1c904d8" - } - ], - "database_specific": "" - } - ], - "versions": 169, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" - } - ] - }, - { - "id": "CVE-2026-8286", - "summary": "wrong STARTTLS connection reuse", - "details": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", - "aliases": ["CURL-CVE-2026-8286"], - "modified": "", - "published": "2026-07-03T06:14:17.541Z", - "related": [ - "ALSA-2026:55439", - "ALSA-2026:57462", - "SUSE-SU-2026:22553-1", - "SUSE-SU-2026:22582-1", - "SUSE-SU-2026:22709-1", - "SUSE-SU-2026:22889-1", - "SUSE-SU-2026:2925-1", - "SUSE-SU-2026:2926-1", - "SUSE-SU-2026:3043-1", - "SUSE-SU-2026:3814-1", - "openSUSE-SU-2026:11230-1", - "openSUSE-SU-2026:21272-1" - ], - "database_specific": "", - "references": [ { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-8286.html" + "url": "http://seclists.org/fulldisclosure/2025/Apr/5" }, { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-8286.json" + "url": "http://seclists.org/fulldisclosure/2025/Apr/8" }, { "type": "WEB", - "url": "https://hackerone.com/reports/3718195" + "url": "http://seclists.org/fulldisclosure/2025/Apr/9" }, { - "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8286.json" + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/11/06/2" }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286" - } - ], - "affected": [ - { - "ranges": [ - { - "type": "GIT", - "repo": "https://github.com/curl/curl", - "events": [ - { - "introduced": "80d241046e404233537ff35efabb703a0668c7d5" - }, - { - "fixed": "68720b4837284335b2d63cb358f8f6ce65f5bc55" - } - ], - "database_specific": "" - } - ], - "versions": 118, - "database_specific": "" - } - ], - "schema_version": "1.9.0", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" - } - ] - }, - { - "id": "CVE-2026-8458", - "summary": "wrong reuse for different services", - "details": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n'services'.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", - "aliases": ["CURL-CVE-2026-8458"], - "modified": "", - "published": "2026-07-03T06:14:42.258Z", - "related": [ - "SUSE-SU-2026:22553-1", - "SUSE-SU-2026:22582-1", - "SUSE-SU-2026:22709-1", - "SUSE-SU-2026:22889-1", - "SUSE-SU-2026:2925-1", - "SUSE-SU-2026:2926-1", - "SUSE-SU-2026:3043-1", - "SUSE-SU-2026:3814-1", - "openSUSE-SU-2026:11230-1", - "openSUSE-SU-2026:21272-1" - ], - "database_specific": "", - "references": [ { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-8458.html" + "url": "https://curl.se/docs/CVE-2024-9681.html" }, { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-8458.json" + "url": "https://curl.se/docs/CVE-2024-9681.json" }, { "type": "WEB", - "url": "https://hackerone.com/reports/3721183" + "url": "https://hackerone.com/reports/2764830" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9681.json" }, { "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8458.json" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9681" }, { "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458" + "url": "https://security.netapp.com/advisory/ntap-20241213-0006/" } ], "affected": [ @@ -5608,16 +3478,16 @@ "repo": "https://github.com/curl/curl", "events": [ { - "introduced": "e2ae32ff5f3ab6f0819590f61f248f17df12987f" + "introduced": "e052859759b34d0e05ce0f17244873e5cd7b457b" }, { - "fixed": "a05f34973e6c4bb629d018f7cb51487be1c904d8" + "fixed": "b1ef0e1a01c0bb6ee5367bd9c186a603bde3615a" } ], "database_specific": "" } ], - "versions": 97, + "versions": 37, "database_specific": "" } ], @@ -5625,51 +3495,49 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ] }, { - "id": "CVE-2026-8924", - "summary": "trailing dot domain super cookie", - "details": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n'super cookies' that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.", - "aliases": ["CURL-CVE-2026-8924"], + "id": "CVE-2025-0167", + "summary": "netrc and default credential leak", + "details": "When asked to use a `.netrc` file for credentials **and** to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has a `default` entry that\nomits both login and password. A rare circumstance.", + "aliases": ["CURL-CVE-2025-0167"], "modified": "", - "published": "2026-07-03T06:15:04.646Z", + "published": "2025-02-05T09:15:06.891Z", "related": [ - "SUSE-SU-2026:22553-1", - "SUSE-SU-2026:22582-1", - "SUSE-SU-2026:22709-1", - "SUSE-SU-2026:22889-1", - "SUSE-SU-2026:2925-1", - "SUSE-SU-2026:2926-1", - "SUSE-SU-2026:3043-1", - "SUSE-SU-2026:3814-1", - "openSUSE-SU-2026:11230-1", - "openSUSE-SU-2026:11266-1", - "openSUSE-SU-2026:21272-1" + "SUSE-SU-2025:0369-1", + "SUSE-SU-2025:0370-1", + "SUSE-SU-2025:0371-1", + "SUSE-SU-2025:0372-1", + "SUSE-SU-2025:20144-1" ], "database_specific": "", "references": [ { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-8924.html" + "url": "https://curl.se/docs/CVE-2025-0167.html" }, { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-8924.json" + "url": "https://curl.se/docs/CVE-2025-0167.json" }, { "type": "WEB", - "url": "https://hackerone.com/reports/3733905" + "url": "https://hackerone.com/reports/2917232" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0167.json" }, { "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8924.json" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0167" }, { "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8924" + "url": "https://security.netapp.com/advisory/ntap-20250306-0008/" } ], "affected": [ @@ -5680,16 +3548,16 @@ "repo": "https://github.com/curl/curl", "events": [ { - "introduced": "e2ae32ff5f3ab6f0819590f61f248f17df12987f" + "introduced": "3266b35bbe21c68dea0dc7ccd991eb028e6d360c" }, { - "fixed": "68720b4837284335b2d63cb358f8f6ce65f5bc55" + "fixed": "34cf9d54a46598c44938aa7598820484d7af7133" } ], "database_specific": "" } ], - "versions": 101, + "versions": 37, "database_specific": "" } ], @@ -5697,50 +3565,47 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N" } ] }, { - "id": "CVE-2026-8927", - "summary": "env-set cross-proxy Digest auth state leak", - "details": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", - "aliases": ["CURL-CVE-2026-8927"], + "id": "CVE-2025-5025", + "summary": "No QUIC certificate pinning with wolfSSL", + "details": "libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.", + "aliases": ["CURL-CVE-2025-5025"], "modified": "", - "published": "2026-07-03T06:16:06.376Z", + "published": "2025-05-28T06:29:51.915Z", "related": [ - "ALSA-2026:55432", - "SUSE-SU-2026:22553-1", - "SUSE-SU-2026:22582-1", - "SUSE-SU-2026:22709-1", - "SUSE-SU-2026:22889-1", - "SUSE-SU-2026:2925-1", - "SUSE-SU-2026:2926-1", - "SUSE-SU-2026:3043-1", - "openSUSE-SU-2026:11230-1", - "openSUSE-SU-2026:21272-1" + "SUSE-SU-2025:03198-1", + "SUSE-SU-2025:20675-1", + "openSUSE-SU-2025:15176-1" ], "database_specific": "", "references": [ { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-8927.html" + "url": "http://www.openwall.com/lists/oss-security/2025/05/28/5" + }, + { + "type": "WEB", + "url": "https://curl.se/docs/CVE-2025-5025.html" }, { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-8927.json" + "url": "https://curl.se/docs/CVE-2025-5025.json" }, { "type": "WEB", - "url": "https://hackerone.com/reports/3744543" + "url": "https://hackerone.com/reports/3153497" }, { "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8927.json" + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5025.json" }, { "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8927" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5025" } ], "affected": [ @@ -5751,16 +3616,16 @@ "repo": "https://github.com/curl/curl", "events": [ { - "introduced": "39626d8cfdd8f858d2fa67ec18204ebc5913d532" + "introduced": "7161cb17c01dcff1dc5bf89a18437d9d729f1ecd" }, { - "fixed": "68720b4837284335b2d63cb358f8f6ce65f5bc55" + "fixed": "4dacb79fcdd9364c1083e06f6a011d797a344f47" } ], "database_specific": "" } ], - "versions": 173, + "versions": 14, "database_specific": "" } ], @@ -5768,39 +3633,51 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" } ] }, { - "id": "CVE-2026-8932", - "summary": "incomplete mTLS config matching in conn reuse", - "details": "libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key.", - "aliases": ["CURL-CVE-2026-8932"], + "id": "CVE-2026-1965", + "summary": "bad reuse of HTTP Negotiate connection", + "details": "libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it just sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl's reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API).", + "aliases": ["CURL-CVE-2026-1965"], "modified": "", - "published": "2026-07-03T06:16:30.485Z", - "related": ["openSUSE-SU-2026:11230-1"], + "published": "2026-03-11T10:08:52.431Z", + "related": [ + "ALSA-2026:55439", + "SUSE-SU-2026:0879-1", + "SUSE-SU-2026:0885-1", + "SUSE-SU-2026:0903-1", + "SUSE-SU-2026:0911-1", + "SUSE-SU-2026:0921-1", + "SUSE-SU-2026:1717-1", + "SUSE-SU-2026:1940-1", + "SUSE-SU-2026:20668-1", + "SUSE-SU-2026:20722-1", + "SUSE-SU-2026:20760-1", + "SUSE-SU-2026:20918-1", + "SUSE-SU-2026:21452-1", + "openSUSE-SU-2026:10371-1", + "openSUSE-SU-2026:20404-1" + ], "database_specific": "", "references": [ { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-8932.html" - }, - { - "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-8932.json" + "url": "https://curl.se/docs/CVE-2026-1965.html" }, { "type": "WEB", - "url": "https://hackerone.com/reports/3733910" + "url": "https://curl.se/docs/CVE-2026-1965.json" }, { "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8932.json" + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1965.json" }, { "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965" } ], "affected": [ @@ -5811,16 +3688,16 @@ "repo": "https://github.com/curl/curl", "events": [ { - "introduced": "546572da0457f37c698c02d0a08d90fdfcbeedec" + "introduced": "bdb5e5a25037a585e0ec6b83d29b25961c6823f8" }, { - "fixed": "68720b4837284335b2d63cb358f8f6ce65f5bc55" + "fixed": "8c908d2d0a6d32abdedda2c52e90bd56ec76c24d" } ], "database_specific": "" } ], - "versions": 209, + "versions": 171, "database_specific": "" } ], @@ -5828,51 +3705,56 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ] }, { - "id": "CVE-2026-9547", - "summary": "SSH improper host validation", - "details": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.", - "aliases": ["CURL-CVE-2026-9547"], + "id": "CVE-2026-3783", + "summary": "token leak with redirect and netrc", + "details": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.", + "aliases": ["CURL-CVE-2026-3783"], "modified": "", - "published": "2026-07-03T06:18:44.499Z", + "published": "2026-03-11T10:09:08.746Z", "related": [ "ALSA-2026:55439", - "SUSE-SU-2026:22553-1", - "SUSE-SU-2026:22582-1", - "SUSE-SU-2026:22709-1", - "SUSE-SU-2026:22889-1", - "SUSE-SU-2026:2925-1", - "SUSE-SU-2026:2926-1", - "SUSE-SU-2026:3043-1", - "SUSE-SU-2026:3814-1", - "openSUSE-SU-2026:11230-1", - "openSUSE-SU-2026:21272-1" + "SUSE-SU-2026:0879-1", + "SUSE-SU-2026:0885-1", + "SUSE-SU-2026:0903-1", + "SUSE-SU-2026:0911-1", + "SUSE-SU-2026:0921-1", + "SUSE-SU-2026:20668-1", + "SUSE-SU-2026:20722-1", + "SUSE-SU-2026:20760-1", + "SUSE-SU-2026:20918-1", + "openSUSE-SU-2026:10371-1", + "openSUSE-SU-2026:20404-1" ], "database_specific": "", "references": [ { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-9547.html" + "url": "http://www.openwall.com/lists/oss-security/2026/03/11/2" + }, + { + "type": "WEB", + "url": "https://curl.se/docs/CVE-2026-3783.html" }, { "type": "WEB", - "url": "https://curl.se/docs/CVE-2026-9547.json" + "url": "https://curl.se/docs/CVE-2026-3783.json" }, { "type": "WEB", - "url": "https://hackerone.com/reports/3751712" + "url": "https://hackerone.com/reports/3583983" }, { "type": "ADVISORY", - "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9547.json" + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3783.json" }, { "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783" } ], "affected": [ @@ -5883,16 +3765,16 @@ "repo": "https://github.com/curl/curl", "events": [ { - "introduced": "b8d1366852fd0034374c5de1e4968c7a224f77cc" + "introduced": "f77e89c5d20db09eaebf378ec036a7e796932810" }, { - "fixed": "68720b4837284335b2d63cb358f8f6ce65f5bc55" + "fixed": "8c908d2d0a6d32abdedda2c52e90bd56ec76c24d" } ], "database_specific": "" } ], - "versions": 63, + "versions": 107, "database_specific": "" } ], @@ -5900,7 +3782,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ] } diff --git a/vulnfeeds/go.mod b/vulnfeeds/go.mod index fefede2b000..5de78069155 100644 --- a/vulnfeeds/go.mod +++ b/vulnfeeds/go.mod @@ -1,6 +1,6 @@ module github.com/google/osv.dev/vulnfeeds -go 1.27.0 +go 1.27.1 require ( charm.land/lipgloss/v2 v2.0.6 @@ -23,9 +23,9 @@ require ( go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 go.opentelemetry.io/otel/sdk v1.46.0 go.opentelemetry.io/otel/trace v1.46.0 - golang.org/x/sync v0.22.0 + golang.org/x/sync v0.23.0 golang.org/x/text v0.41.0 - google.golang.org/api v0.294.0 + google.golang.org/api v0.297.0 google.golang.org/grpc v1.83.2 google.golang.org/protobuf v1.36.12 gopkg.in/dnaeon/go-vcr.v4 v4.0.7 diff --git a/vulnfeeds/go.sum b/vulnfeeds/go.sum index 33e65e7cb4d..ed4f51b98fc 100644 --- a/vulnfeeds/go.sum +++ b/vulnfeeds/go.sum @@ -348,8 +348,8 @@ golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -383,8 +383,8 @@ golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhS golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.294.0 h1:8gASjJxdtcIieB3OqbkLcF0FfbXVNqKtU5iozD1ssvA= -google.golang.org/api v0.294.0/go.mod h1:02qB8+Ox1ZFzcaKFMguy1nQLJmSIyvV6Ff4txJEXtl4= +google.golang.org/api v0.297.0 h1:WktxTsnnx0yZNnsR6j0q6hR21RnnK81FHTOPy/ux4OE= +google.golang.org/api v0.297.0/go.mod h1:S4m8x0M6OkQpkOzGk1y9JG2sm4fFQrMh6dxzjCTszhE= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=