CVE-2026-8286

LLM-synthesized narrative grounded in this CVE's description and references.

• osv-coords17 versions

  pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/eco-python-curl-minimal-devpkg:apk/chainguard/eco-python-curl-nghttp2pkg:apk/chainguard/eco-python-curl-minimal-binpkg:apk/chainguard/eco-python-curl-minimalpkg:rpm/almalinux/libcurlpkg:apk/chainguard/eco-python-curl-nghttp2-devpkg:apk/chainguard/eco-python-curl-nghttp2-staticpkg:rpm/almalinux/curl-minimalpkg:rpm/almalinux/curlpkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweedpkg:apk/chainguard/eco-python-curlpkg:apk/chainguard/eco-python-curl-minimal-staticpkg:rpm/almalinux/libcurl-develpkg:rpm/almalinux/libcurl-minimalpkg:apk/chainguard/eco-python-curl-minimal-docpkg:apk/chainguard/eco-python-curl-nghttp2-bin

  < 8.14.1-160000.8.1+ 16 more

  • (no CPE)range: < 8.14.1-160000.8.1
  • (no CPE)range: < 8.21.0-r0
  • (no CPE)range: < 8.21.0-r0
  • (no CPE)range: < 8.21.0-r0
  • (no CPE)range: < 8.21.0-r0
  • (no CPE)range: < 7.76.1-40.el9_8.5
  • (no CPE)range: < 8.21.0-r0
  • (no CPE)range: < 8.21.0-r0
  • (no CPE)range: < 7.76.1-40.el9_8.5
  • (no CPE)range: < 7.76.1-40.el9_8.5
  • (no CPE)range: < 8.21.0-1.1
  • (no CPE)range: < 8.21.0-r0
  • (no CPE)range: < 8.21.0-r0
  • (no CPE)range: < 7.76.1-40.el9_8.5
  • (no CPE)range: < 7.76.1-40.el9_8.5
  • (no CPE)range: < 8.21.0-r0
  • (no CPE)range: < 8.21.0-r0
• Curl/Curl2 versions

  cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*+ 1 more

  • cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*range: >=7.30.0,<8.21.0
  • (no CPE)

• curl.se/docs/CVE-2026-8286.htmlnvdPatchVendor Advisory
• hackerone.com/reports/3718195nvdExploitIssue TrackingThird Party Advisory
• curl.se/docs/CVE-2026-8286.jsonnvdVendor Advisory

• 25-Year-Old Vulnerability in cURL Used by 30 Billion Devices Finally Patched
  Cyber Security News · Jun 25, 2026