Curl Patches 24 Vulnerabilities, Including Credential Leaks and Command Injection
The curl project has released version 8.23.0, addressing 24 security vulnerabilities in libcurl, ranging from critical credential leaks to command injection flaws.
The curl project has released curl 8.23.0, a significant update that patches a total of 24 security vulnerabilities affecting the widely used data transfer tool and its underlying library, libcurl. These vulnerabilities encompass a range of critical issues including credential leaks, authentication errors, and command injection flaws, posing risks to applications that rely on curl for data transfer.
Of particular concern is CVE-2026-86414, a vulnerability where an HTTP proxy can intercept credentials intended for the destination server. During a CONNECT tunnel request, a malicious proxy can respond with a 401 authentication challenge, tricking libcurl into revealing Basic authentication passwords or Negotiate/Kerberos tickets. This flaw impacts versions 7.10.8 through 8.22.0.
Another notable vulnerability, CVE-2026-94266, can lead to the exposure of passwords through the CURLINFO_EFFECTIVE_URL option. When curl retrieves credentials from a .netrc file, applications that log the effective URL could inadvertently record these sensitive credentials. This issue affects versions 7.62.0 through 8.22.0.
The release also addresses CVE-2026-87864, an IMAP command injection flaw discovered by AISLE. This vulnerability arises during message uploads when using CURLOPT_CRLF, where a mismatch between the declared message size and the actual transmitted bytes can allow extra bytes to be interpreted as commands within an authenticated IMAP session. While fixed in curl 8.22.0, its advisory was published alongside the 8.23.0 release and affects versions 7.30.0 through 8.21.0.
Security firm AISLE played a significant role in discovering these vulnerabilities, auditing 24 CVEs across two releases. Their audit identified 18 vulnerabilities addressed in curl 8.23.0 and six in curl 8.22.0, though these figures represent AISLE's findings and not the complete security count for either release.
Beyond these specific examples, the 24 patched vulnerabilities include issues such as stale AWS signing headers, redirect bypasses for SSH host verification, reused FTP connections inheriting client certificates, and improper HSTS cache handling. Several vulnerabilities can lead to endless loops or stack exhaustion, disrupting application stability.
In addition to the security fixes, curl 8.23.0 removes support for the SMB and SMBS protocols. This change necessitates compatibility checks for users who rely on these protocols, as applications may need to be updated or reconfigured.
The broad impact of curl, with an estimated 30 billion installations worldwide, underscores the critical importance of applying these security updates promptly to mitigate the risks associated with credential leaks, unauthorized access, and potential command injection.