HA
Vendor
Haxx
230
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-82209 | CU Curl Haxx | 8.2 | Sep 6 | domain-scoped PSL domain cookie |
| CVE-2026-82208 | CU Curl Haxx | 7.5 | Sep 6 | wolfSSL CA-cache hit overrides callback |
| CVE-2026-80255 | CU Curl Haxx | 7.5 | Sep 6 | secure cookie attribute bypass with tab |
| CVE-2026-80231 | CU Curl Haxx | 7.5 | Sep 6 | native CA store conn reuse |
| CVE-2026-80230 | CU Curl Haxx | 7.5 | Sep 6 | OpenSSL pinning bypass |
| CVE-2026-80229 | CU Curl Haxx | 7.5 | Sep 6 | OpenSSL provider use-after-free |
| CVE-2026-19931 | CU Curl Haxx | 9.8 | Sep 6 | Negotiate ambient user conn reuse |
| CVE-2026-18924 | CU Curl Haxx | 9.1 | Sep 6 | HTTP/2 server push UAF |
| CVE-2026-13608 | CU Curl Haxx | 7.4 | Sep 6 | OpenLDAP SASL authentication bypass |
| CVE-2026-9547 | CU Curl Haxx | 7.4 | Jul 3 | SSH improper host validation |
| CVE-2026-9546 | CU Curl Haxx | 7.5 | Jul 3 | sending old referer |
| CVE-2026-9545 | CU Curl Haxx | 7.5 | Jul 3 | exposing HTTP/3 early data |
| CVE-2026-9080 | CU Curl Haxx | 7.3 | Jul 3 | UAF after pause in socket callback |
| CVE-2026-9079 | CU Curl Haxx | 9.8 | Jul 3 | stale proxy password leak |
| CVE-2026-8932 | CU Curl Haxx | 7.5 | Jul 3 | incomplete mTLS config matching in conn reuse |
| CVE-2026-8927 | CU Curl Haxx | 9.1 | Jul 3 | env-set cross-proxy Digest auth state leak |
| CVE-2026-8926 | CU Curl Haxx | 9.1 | Jul 3 | password leak with netrc and user in URL |
| CVE-2026-8925 | CU Curl Haxx | 9.8 | Jul 3 | SASL double-free |
| CVE-2026-8924 | CU Curl Haxx | 9.1 | Jul 3 | trailing dot domain super cookie |
| CVE-2026-8458 | CU Curl Haxx | 6.5 | Jul 3 | wrong reuse for different services |
| CVE-2026-8286 | CU Curl Haxx | 8.1 | Jul 3 | wrong STARTTLS connection reuse |
| CVE-2026-12064 | CU Curl Haxx | 7.5 | Jul 3 | proto-default skips SSH verification |
| CVE-2026-11856 | CU Curl Haxx | 9.8 | Jul 3 | cross-origin Digest auth state leak |
| CVE-2026-11586 | CU Curl Haxx | 7.5 | Jul 3 | WS Auto-PONG memory exhaustion |
| CVE-2026-11564 | CU Curl Haxx | 9.1 | Jul 3 | Native CA trust persist |
| CVE-2026-11352 | CU Curl Haxx | 7.5 | Jul 3 | QUIC zero-length UDP datagrams busy-loop |
| CVE-2026-10536 | CU Curl Haxx | 9.8 | Jul 3 | HTTP/2 stream-dependency tree UAF |
| CVE-2026-7168 | CU Curl Haxx | 5.3 | May 13 | cross-proxy Digest auth state leak |
| CVE-2026-7009 | CU Curl Haxx | 5.3 | May 13 | OCSP stapling bypass with Apple SecTrust |
| CVE-2026-6429 | CU Curl Haxx | 5.3 | May 13 | netrc credential leak with reused proxy connection |
| CVE-2026-6276 | CU Curl Haxx | 7.5 | May 13 | stale custom cookie host causes cookie leak |
| CVE-2026-6253 | CU Curl Haxx | 5.9 | May 13 | proxy credentials leak over redirect-to proxy |
| CVE-2026-5773 | CU Curl Haxx | 7.5 | May 13 | wrong reuse of SMB connection |
| CVE-2026-5545 | CU Curl Haxx | 6.5 | May 13 | wrong reuse of HTTP Negotiate connection |
| CVE-2026-4873 | CU Curl Haxx | 5.9 | May 13 | connection reuse ignores TLS requirement |
| CVE-2026-3805 | CU Curl Haxx | 7.5 | Mar 11 | use after free in SMB connection reuse |
| CVE-2026-3784 | CU Curl Haxx | 6.5 | Mar 11 | wrong proxy connection reuse with credentials |
| CVE-2026-3783 | CU Curl Haxx | 5.3 | Mar 11 | token leak with redirect and netrc |
| CVE-2026-1965 | CU Curl Haxx | 6.5 | Mar 11 | bad reuse of HTTP Negotiate connection |
| CVE-2025-15224 | CU Curl Haxx | 3.1 | Jan 8 | libssh key passphrase bypass without agent set |
| CVE-2025-15079 | CU Curl Haxx | 5.3 | Jan 8 | libssh global known_hosts override |
| CVE-2025-14819 | CU Curl Haxx | 5.3 | Jan 8 | OpenSSL partial chain store policy bypass |
| CVE-2025-14524 | CU Curl Haxx | 5.3 | Jan 8 | bearer token leak on cross-protocol redirect |
| CVE-2025-14017 | CU Curl Haxx | 6.3 | Jan 8 | broken TLS options for threaded LDAPS |
| CVE-2025-13034 | CU Curl Haxx | 5.9 | Jan 8 | No QUIC certificate pinning with GnuTLS |
| CVE-2025-10966 | CU Curl Haxx | 4.3 | Nov 7 | missing SFTP host verification with wolfSSH |
| CVE-2025-10148 | CU Curl Haxx | 5.3 | Sep 12 | predictable WebSocket mask |
| CVE-2025-9086 | CU Curl Haxx | 7.5 | Sep 12 | Out of bounds read for cookie path |
| CVE-2025-5399 | CU Curl Haxx | 7.5 | Jun 7 | WebSocket endless loop |
| CVE-2025-5025 | CU Curl Haxx | 4.8 | May 28 | No QUIC certificate pinning with wolfSSL |
| CVE-2025-4947 | CU Curl Haxx | 6.5 | May 28 | QUIC certificate check skip with wolfSSL |
| CVE-2025-0725 | LI Libcurl Haxx | 7.3 | Feb 5 | gzip integer overflow |
| CVE-2025-0665 | CU Curl Haxx | 7.0 | Feb 5 | eventfd double close |
| CVE-2025-0167 | CU Curl Haxx | 3.4 | Feb 5 | netrc and default credential leak |
| CVE-2024-11053 | CU Curl Haxx | 3.4 | Dec 11 | netrc and redirect credential leak |
| CVE-2024-9681 | CU Curl Haxx | 6.5 | Nov 6 | HSTS subdomain overwrites parent cache entry |
| CVE-2024-8096 | CU Curl Haxx | 6.5 | Sep 11 | OCSP stapling bypass with GnuTLS |
| CVE-2024-32928 | LI Libcurl Haxx | 5.9 | Aug 19 | The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to… |
| CVE-2024-7264 | LI Libcurl Haxx | 6.5 | Jul 31 | ASN.1 date parser overread |
| CVE-2024-6874 | LI Libcurl Haxx | 4.3 | Jul 24 | libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN |