{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "curl: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/curl--curl/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/curl--curl/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107929/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107929/",
   "title": "CVE-2026-107929 · curl · disclosed",
   "content_text": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address",
   "date_published": "2026-10-20T20:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107929/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107929/",
   "title": "CVE-2026-107929 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107929/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107929/",
   "title": "CVE-2026-107929 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107929/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107929/",
   "title": "CVE-2026-107929 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107929/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107929/",
   "title": "CVE-2026-107929 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107929/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107929/",
   "title": "CVE-2026-107929 · curl · fixed in Ubuntu 26.04 LTS (curl 8.18.0-1ubuntu2.8)",
   "content_text": "Fixed versions: curl 8.18.0-1ubuntu2.8.",
   "date_published": "2026-10-20T20:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107929/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107929/",
   "title": "CVE-2026-107929 · curl · fixed in Ubuntu 26.10 (curl 8.20.0-2ubuntu11.1)",
   "content_text": "Fixed versions: curl 8.20.0-2ubuntu11.1.",
   "date_published": "2026-10-20T20:29:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107928/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107928/",
   "title": "CVE-2026-107928 · curl · disclosed",
   "content_text": "When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send.",
   "date_published": "2026-10-20T20:28:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107928/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107928/",
   "title": "CVE-2026-107928 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:28:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107928/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107928/",
   "title": "CVE-2026-107928 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:28:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107928/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107928/",
   "title": "CVE-2026-107928 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:28:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107928/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107928/",
   "title": "CVE-2026-107928 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:28:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107928/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107928/",
   "title": "CVE-2026-107928 · curl · fixed in Ubuntu 26.04 LTS (curl 8.18.0-1ubuntu2.8)",
   "content_text": "Fixed versions: curl 8.18.0-1ubuntu2.8.",
   "date_published": "2026-10-20T20:28:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107928/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107928/",
   "title": "CVE-2026-107928 · curl · fixed in Ubuntu 26.10 (curl 8.20.0-2ubuntu11.1)",
   "content_text": "Fixed versions: curl 8.20.0-2ubuntu11.1.",
   "date_published": "2026-10-20T20:28:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · disclosed",
   "content_text": "libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Ubuntu 22.04 LTS (curl 7.81.0-1ubuntu1.30)",
   "content_text": "Fixed versions: curl 7.81.0-1ubuntu1.30.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Ubuntu 24.04 LTS (curl 8.5.0-2ubuntu10.16)",
   "content_text": "Fixed versions: curl 8.5.0-2ubuntu10.16.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Ubuntu 26.04 LTS (curl 8.18.0-1ubuntu2.8)",
   "content_text": "Fixed versions: curl 8.18.0-1ubuntu2.8.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Ubuntu 26.10 (curl 8.20.0-2ubuntu11.1)",
   "content_text": "Fixed versions: curl 8.20.0-2ubuntu11.1.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/ubuntu-pro-14.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Ubuntu Pro 14.04 LTS (curl 7.35.0-1ubuntu2.20+esm24)",
   "content_text": "Fixed versions: curl 7.35.0-1ubuntu2.20+esm24.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Ubuntu Pro 16.04 LTS (curl 7.47.0-1ubuntu2.19+esm21)",
   "content_text": "Fixed versions: curl 7.47.0-1ubuntu2.19+esm21.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Ubuntu Pro 18.04 LTS (curl 7.58.0-2ubuntu3.24+esm15)",
   "content_text": "Fixed versions: curl 7.58.0-2ubuntu3.24+esm15.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94266/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94266/",
   "title": "CVE-2026-94266 · curl · fixed in Ubuntu Pro 20.04 LTS (curl 7.68.0-1ubuntu2.25+esm10)",
   "content_text": "Fixed versions: curl 7.68.0-1ubuntu2.25+esm10.",
   "date_published": "2026-10-20T20:27:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94265/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94265/",
   "title": "CVE-2026-94265 · curl · disclosed",
   "content_text": "When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`.",
   "date_published": "2026-10-20T20:26:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94265/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94265/",
   "title": "CVE-2026-94265 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:26:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94265/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94265/",
   "title": "CVE-2026-94265 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:26:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94265/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94265/",
   "title": "CVE-2026-94265 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:26:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94265/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94265/",
   "title": "CVE-2026-94265 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:26:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · disclosed",
   "content_text": "A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Ubuntu 22.04 LTS (curl 7.81.0-1ubuntu1.30)",
   "content_text": "Fixed versions: curl 7.81.0-1ubuntu1.30.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Ubuntu 24.04 LTS (curl 8.5.0-2ubuntu10.16)",
   "content_text": "Fixed versions: curl 8.5.0-2ubuntu10.16.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Ubuntu 26.04 LTS (curl 8.18.0-1ubuntu2.8)",
   "content_text": "Fixed versions: curl 8.18.0-1ubuntu2.8.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Ubuntu 26.10 (curl 8.20.0-2ubuntu11.1)",
   "content_text": "Fixed versions: curl 8.20.0-2ubuntu11.1.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/ubuntu-pro-14.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Ubuntu Pro 14.04 LTS (curl 7.35.0-1ubuntu2.20+esm24)",
   "content_text": "Fixed versions: curl 7.35.0-1ubuntu2.20+esm24.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Ubuntu Pro 16.04 LTS (curl 7.47.0-1ubuntu2.19+esm21)",
   "content_text": "Fixed versions: curl 7.47.0-1ubuntu2.19+esm21.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Ubuntu Pro 18.04 LTS (curl 7.58.0-2ubuntu3.24+esm15)",
   "content_text": "Fixed versions: curl 7.58.0-2ubuntu3.24+esm15.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92391/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92391/",
   "title": "CVE-2026-92391 · curl · fixed in Ubuntu Pro 20.04 LTS (curl 7.68.0-1ubuntu2.25+esm10)",
   "content_text": "Fixed versions: curl 7.68.0-1ubuntu2.25+esm10.",
   "date_published": "2026-10-20T20:24:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92390/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92390/",
   "title": "CVE-2026-92390 · curl · disclosed",
   "content_text": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint.",
   "date_published": "2026-10-20T20:23:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92390/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92390/",
   "title": "CVE-2026-92390 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:23:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92390/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92390/",
   "title": "CVE-2026-92390 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:23:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92390/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92390/",
   "title": "CVE-2026-92390 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:23:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92390/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92390/",
   "title": "CVE-2026-92390 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:23:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92390/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92390/",
   "title": "CVE-2026-92390 · curl · fixed in Ubuntu 26.04 LTS (curl 8.18.0-1ubuntu2.8)",
   "content_text": "Fixed versions: curl 8.18.0-1ubuntu2.8.",
   "date_published": "2026-10-20T20:23:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92390/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92390/",
   "title": "CVE-2026-92390 · curl · fixed in Ubuntu 26.10 (curl 8.20.0-2ubuntu11.1)",
   "content_text": "Fixed versions: curl 8.20.0-2ubuntu11.1.",
   "date_published": "2026-10-20T20:23:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · disclosed",
   "content_text": "libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Ubuntu 22.04 LTS (curl 7.81.0-1ubuntu1.30)",
   "content_text": "Fixed versions: curl 7.81.0-1ubuntu1.30.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Ubuntu 24.04 LTS (curl 8.5.0-2ubuntu10.16)",
   "content_text": "Fixed versions: curl 8.5.0-2ubuntu10.16.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Ubuntu 26.04 LTS (curl 8.18.0-1ubuntu2.8)",
   "content_text": "Fixed versions: curl 8.18.0-1ubuntu2.8.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Ubuntu 26.10 (curl 8.20.0-2ubuntu11.1)",
   "content_text": "Fixed versions: curl 8.20.0-2ubuntu11.1.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/ubuntu-pro-14.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Ubuntu Pro 14.04 LTS (curl 7.35.0-1ubuntu2.20+esm24)",
   "content_text": "Fixed versions: curl 7.35.0-1ubuntu2.20+esm24.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Ubuntu Pro 16.04 LTS (curl 7.47.0-1ubuntu2.19+esm21)",
   "content_text": "Fixed versions: curl 7.47.0-1ubuntu2.19+esm21.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Ubuntu Pro 18.04 LTS (curl 7.58.0-2ubuntu3.24+esm15)",
   "content_text": "Fixed versions: curl 7.58.0-2ubuntu3.24+esm15.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92389/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92389/",
   "title": "CVE-2026-92389 · curl · fixed in Ubuntu Pro 20.04 LTS (curl 7.68.0-1ubuntu2.25+esm10)",
   "content_text": "Fixed versions: curl 7.68.0-1ubuntu2.25+esm10.",
   "date_published": "2026-10-20T20:21:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · disclosed",
   "content_text": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Ubuntu 22.04 LTS (curl 7.81.0-1ubuntu1.30)",
   "content_text": "Fixed versions: curl 7.81.0-1ubuntu1.30.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Ubuntu 24.04 LTS (curl 8.5.0-2ubuntu10.16)",
   "content_text": "Fixed versions: curl 8.5.0-2ubuntu10.16.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Ubuntu 26.04 LTS (curl 8.18.0-1ubuntu2.8)",
   "content_text": "Fixed versions: curl 8.18.0-1ubuntu2.8.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Ubuntu 26.10 (curl 8.20.0-2ubuntu11.1)",
   "content_text": "Fixed versions: curl 8.20.0-2ubuntu11.1.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/ubuntu-pro-14.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Ubuntu Pro 14.04 LTS (curl 7.35.0-1ubuntu2.20+esm24)",
   "content_text": "Fixed versions: curl 7.35.0-1ubuntu2.20+esm24.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Ubuntu Pro 16.04 LTS (curl 7.47.0-1ubuntu2.19+esm21)",
   "content_text": "Fixed versions: curl 7.47.0-1ubuntu2.19+esm21.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Ubuntu Pro 18.04 LTS (curl 7.58.0-2ubuntu3.24+esm15)",
   "content_text": "Fixed versions: curl 7.58.0-2ubuntu3.24+esm15.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92388/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92388/",
   "title": "CVE-2026-92388 · curl · fixed in Ubuntu Pro 20.04 LTS (curl 7.68.0-1ubuntu2.25+esm10)",
   "content_text": "Fixed versions: curl 7.68.0-1ubuntu2.25+esm10.",
   "date_published": "2026-10-20T20:20:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92387/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92387/",
   "title": "CVE-2026-92387 · curl · disclosed",
   "content_text": "By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle.",
   "date_published": "2026-10-20T20:19:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92387/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92387/",
   "title": "CVE-2026-92387 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:19:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92387/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92387/",
   "title": "CVE-2026-92387 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:19:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92387/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92387/",
   "title": "CVE-2026-92387 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:19:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92387/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92387/",
   "title": "CVE-2026-92387 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:19:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92387/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92387/",
   "title": "CVE-2026-92387 · curl · fixed in Ubuntu 26.04 LTS (curl 8.18.0-1ubuntu2.8)",
   "content_text": "Fixed versions: curl 8.18.0-1ubuntu2.8.",
   "date_published": "2026-10-20T20:19:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92387/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92387/",
   "title": "CVE-2026-92387 · curl · fixed in Ubuntu 26.10 (curl 8.20.0-2ubuntu11.1)",
   "content_text": "Fixed versions: curl 8.20.0-2ubuntu11.1.",
   "date_published": "2026-10-20T20:19:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92386/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92386/",
   "title": "CVE-2026-92386 · curl · disclosed",
   "content_text": "When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile.",
   "date_published": "2026-10-20T20:17:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92386/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92386/",
   "title": "CVE-2026-92386 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:17:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92386/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92386/",
   "title": "CVE-2026-92386 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:17:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92386/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92386/",
   "title": "CVE-2026-92386 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:17:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92386/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92386/",
   "title": "CVE-2026-92386 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:17:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92386/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92386/",
   "title": "CVE-2026-92386 · curl · fixed in Ubuntu 26.04 LTS (curl 8.18.0-1ubuntu2.8)",
   "content_text": "Fixed versions: curl 8.18.0-1ubuntu2.8.",
   "date_published": "2026-10-20T20:17:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92386/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92386/",
   "title": "CVE-2026-92386 · curl · fixed in Ubuntu 26.10 (curl 8.20.0-2ubuntu11.1)",
   "content_text": "Fixed versions: curl 8.20.0-2ubuntu11.1.",
   "date_published": "2026-10-20T20:17:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87866/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87866/",
   "title": "CVE-2026-87866 · curl · disclosed",
   "content_text": "When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.",
   "date_published": "2026-10-20T20:16:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87866/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87866/",
   "title": "CVE-2026-87866 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:16:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87866/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87866/",
   "title": "CVE-2026-87866 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:16:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87866/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87866/",
   "title": "CVE-2026-87866 · curl · fixed in openSUSE Tumbleweed (curl 8.23.0-1.1)",
   "content_text": "Fixed versions: curl 8.23.0-1.1.",
   "date_published": "2026-10-20T20:16:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87866/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87866/",
   "title": "CVE-2026-87866 · curl · fixed in Red Hat hummingbird 1 (curl 0:8.23.0-0.1.hum1 and 3 more)",
   "content_text": "Fixed versions: curl 0:8.23.0-0.1.hum1, libcurl 0:8.23.0-0.1.hum1, libcurl-devel 0:8.23.0-0.1.hum1, libcurl-minimal 0:8.23.0-0.1.hum1.",
   "date_published": "2026-10-20T20:16:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87865/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87865/",
   "title": "CVE-2026-87865 · curl · disclosed",
   "content_text": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.",
   "date_published": "2026-10-20T20:15:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87865/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87865/",
   "title": "CVE-2026-87865 · curl · fixed in Alpine 3.23 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:15:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87865/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87865/",
   "title": "CVE-2026-87865 · curl · fixed in Alpine 3.24 (curl 8.23.0-r0)",
   "content_text": "Fixed versions: curl 8.23.0-r0.",
   "date_published": "2026-10-20T20:15:13Z"
  }
 ]
}