🛡️ OESA-2026-2984 — curl

curl security update

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the

connection might reuse an existing live connection even though the TLS

configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set

'super cookies' that bypass the Public Suffix List check. This enables an

attacker-controlled origin to inject cookies that curl subsequently scopes and

transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by

environment-variable proxy configuration, libcurl fails to clear the proxy

authentication state between requests. Specifically, if the initial transfer

authenticates against proxyA using Digest auth, a subsequent transfer routed

through proxyB erroneously leaks the Proxy-Authorization: header intended

solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP://

and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an

untrusted server. This vulnerability occurs when a server presents a host key

type that does not match the specific key type already recorded for that host

in the known_hosts file. Instead of rejecting the mismatch, the callback

mechanism fails to properly enforce the restriction, allowing the connection

to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)