The curl project released curl 8.23.0 on October 14, 2026, announcing 24 security fixes affecting the widely used data transfer tool and its underlying library, libcurl.
The vulnerabilities include credential leaks, authentication errors, command injection, and flaws that can disrupt applications. The release also removes SMB and SMBS protocol support, making compatibility checks important before deployment.
According to security firm AISLE, it discovered 18 of the vulnerabilities announced with this release, representing 75 percent of the total.
Its dedicated audit produced 24 CVEs across two releases, with six addressed in curl 8.22.0 and another eighteen associated with 8.23.0. Those figures describe AISLE’s audit findings, not the complete security count for either release.
curl Security Vulnerabilities
One notable flaw, CVE-2026-86414, allows an HTTP proxy to trick libcurl into handing over credentials intended for the destination server.
During a CONNECT tunnel request, the proxy can return a 401 response with a WWW-Authenticate header instead of the expected proxy authentication response.
This can expose a Basic authentication password or a Negotiate/Kerberos ticket. The issue affects versions 7.10.8 through 8.22.0.
Another vulnerability, CVE-2026-94266, can expose passwords through CURLINFO_EFFECTIVE_URL when curl obtains credentials from a .netrc file. The command-line tool can reveal the same information through its url_effective output variable.
Applications that record these returned URLs could therefore place credentials in logs. Versions 7.62.0 through 8.22.0 are affected.
These findings extend a recurring security concern around credential handling. Cybersecurity News previously covered a curl password leak involving redirects and .netrc files, where credentials could reach an unintended host under specific conditions.
The official advisory for CVE-2026-87864 explains an IMAP command injection flaw involving message uploads and CURLOPT_CRLF. Curl advertised the original message size but sent additional bytes after converting line endings.
A mail server could interpret those extra bytes as commands within the authenticated session. This concerns IMAP commands, not operating system shell commands.
Importantly, this flaw was already fixed in curl 8.22.0, although its advisory was published on October 14. It affects versions 7.30.0 through 8.21.0 and carries a low severity rating. Avoiding CURLOPT_CRLF with IMAP is the documented workaround. Recently, cURL patched a 25-Year-Old Vulnerability with version 8.21.0.
Other AISLE findings involve stale AWS signing headers, credentials crossing redirect boundaries, client certificate mix-ups, damaged cookie storage, and incorrect HSTS cache handling. Additional issues can cause an endless loop or exhaust the process stack. These failures often emerge when settings or connection state persist after the destination or identity changes.
| CVE ID | Vulnerability | Affected feature | Security impact |
|---|---|---|---|
| CVE-2026-86409 | Stale AWS SigV4 headers sent to an unintended destination | AWS request signing | Authentication headers can remain attached to a request after its destination changes. |
| CVE-2026-86410 | Redirect bypasses SSH host verification | SFTP and SCP redirects | A redirected connection can skip the host verification needed to confirm the remote server’s identity. |
| CVE-2026-86411 | Reused FTP connection inherits a client certificate | FTP connection reuse | A transfer can reuse a connection authenticated with a client certificate from a previous configuration. |
| CVE-2026-86412 | Server-set cookie erases the cookie jar | Cookie storage | A server-provided cookie can cause stored cookies to be erased. |
| CVE-2026-86413 | Negotiate credentials sent to a redirected origin | Redirects and Negotiate authentication | Authentication information can reach a destination that should not receive it. |
| CVE-2026-86414 | Host credentials leaked to an HTTP proxy | HTTP proxy CONNECT handling | A proxy can obtain credentials intended for the destination server, including Basic authentication passwords or Negotiate/Kerberos tickets. |
| CVE-2026-86415 | Automatic client-certificate connection reuse mix-up | Client certificates and connection reuse | A connection can be reused under the wrong client-certificate identity. |
| CVE-2026-87862 | HSTS cache import drops a longer-lived child entry | HSTS cache loading | An existing child-domain entry with a longer lifetime can be lost during cache import. |
| CVE-2026-87863 | HSTS response erases persisted entries | HSTS cache persistence | Processing a server’s HSTS response can erase stored HTTPS enforcement entries. |
| CVE-2026-87864 | IMAP APPEND command injection during CRLF conversion | IMAP uploads and CURLOPT_CRLF | A mismatch between the declared message size and transmitted bytes can let extra bytes become IMAP commands in an authenticated session. This is not operating system shell injection. |
| CVE-2026-92386 | Server-set cookie aborts cookie-jar loading | Cookie-file loading | A server-provided cookie can interrupt the loading of stored cookies. |
| CVE-2026-92387 | Missing server response data causes a never-ending loop | Server response handling | The affected operation can become stuck in an endless loop, disrupting the application. |
| CVE-2026-92388 | FTP wildcard write callback mix-up | FTP wildcard transfers | Transfer data can reach the wrong application write callback. |
| CVE-2026-92389 | TFTP transfer direction confusion | TFTP transfers | Curl can confuse the intended transfer direction, causing incorrect protocol behavior. |
| CVE-2026-92390 | -J no-clobber protection bypassed through 103 Early Hints | HTTP response headers and output-file handling | An HTTP 103 Early Hints response can bypass protection intended to prevent overwriting an existing file. |
| CVE-2026-92391 | Recursive curl_mime_free calls exhaust the stack | MIME cleanup | Recursive cleanup can exhaust the process stack and crash the application. |
| CVE-2026-94265 | Authorization: Negotiate sent to a foreign origin | HTTP Negotiate authentication | An authentication header can be sent to a different origin that should not receive it. |
| CVE-2026-94266 | Password leak through CURLINFO_EFFECTIVE_URL | Effective URL reporting and .netrc credentials | Returned URLs can expose passwords, potentially placing them in application logs or command-line output. |
Administrators should upgrade affected curl and libcurl installations to 8.23.0 or apply the relevant patches. Check applications that bundle libcurl, since updating the standalone tool may leave embedded copies unchanged.
Review the settings for proxy authentication, credential logging, and IMAP uploads while planning deployment. Before rollout, check the release announcement for any compatibility changes.
An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.
