By vendor

Haxx vulnerabilities

Known CVEs affecting Haxx products, prioritized by severity, with SEC.co remediation and detection guidance.

10 published vulnerabilities

• CVE-2026-8286HIGH 8.1

  A vulnerability in curl allows a new network transfer to incorrectly reuse an existing active connection when upgrading to TLS encryption via STARTTLS, even when the TLS settings don't match between the two transfers. This connection reuse could allow an attacker to intercept or manipulate traffic that should be encrypted with different security parameters, compromising the confidentiality and integrity of data in transit.

• CVE-2026-11352HIGH 7.5

  curl and libcurl clients can be remotely stalled indefinitely by a malicious HTTP/3 server through a flaw in how the library handles empty network packets. An attacker controlling an HTTP/3 server can flood a connecting client with zero-length UDP datagrams, causing the client to hang or become unresponsive. This affects any application using curl or libcurl for HTTP/3 connections without proper timeout mechanisms.

• CVE-2026-11586HIGH 7.5

  A denial-of-service vulnerability exists in curl's WebSocket implementation. By default, curl automatically responds to WebSocket PING frames sent by servers, but it does not enforce a limit on how much memory can be used to store unacknowledged frames. An attacker controlling a malicious WebSocket server can send rapid PING messages faster than curl can process them, causing memory to accumulate without bound until the client system runs out of memory and becomes unresponsive.

• CVE-2026-12064HIGH 7.5

  curl has a vulnerability where using a schemeless URL with the `--proto-default` flag set to sftp or scp causes the command-line tool to incorrectly handle SSH security verification. The tool layer fails to initialize critical host verification options, allowing curl to connect to SSH servers without validating their authenticity. This happens because of a mismatch between how the tool interprets the URL and how the underlying libcurl library processes it, resulting in a silent bypass of security checks that should normally occur.

• CVE-2026-8932HIGH 7.5

  libcurl, a widely-used open-source library for transferring data via URLs, contains a vulnerability in how it manages connections across multiple operations. When you configure client certificate authentication (mTLS), libcurl caches connections for reuse to improve performance. However, the library fails to account for changes in client certificate and private key settings when deciding whether a cached connection is safe to reuse. This means an attacker could potentially cause libcurl to use a connection authenticated with the wrong certificate or key, bypassing intended security controls.

• CVE-2026-9545HIGH 7.5

  CVE-2026-9545 is a flaw in libcurl that can leak sensitive data when making HTTPS requests to servers after a connection has been compromised or replaced by an attacker. The vulnerability occurs because libcurl may transmit request data before fully validating the server's certificate if certain caching and optimization features are enabled. An attacker who can intercept network traffic—such as one positioned on the same network or controlling network infrastructure—could position themselves between the client and server, and libcurl would send sensitive information before detecting the fraudulent certificate.

• CVE-2026-9546HIGH 7.5

  libcurl, a widely-used library for transferring data via URLs, has a flaw in how it handles the HTTP Referer header. When developers attempt to clear this header by passing NULL to the CURLOPT_REFERER option—as the documentation promises—the library fails to actually remove the header from its internal state. Instead, it reuses the previous referrer string in subsequent HTTP requests. This causes sensitive information (such as URLs containing tokens, session IDs, or internal paths) to leak to servers that should never receive that data.

• CVE-2026-9547HIGH 7.4

  A vulnerability in libcurl's SSH functionality allows applications using SCP or SFTP transfers with custom host key verification callbacks to silently accept servers with mismatched host key types. When a server presents a key type different from what's stored in the known_hosts file, the callback mechanism fails to enforce the mismatch, permitting the connection to proceed without warning. This creates a window for man-in-the-middle attacks where an attacker could intercept traffic or inject malicious data.

• CVE-2026-9080HIGH 7.3

  A use-after-free bug in libcurl allows attackers to crash applications or potentially execute code when specific callback functions are invoked during multi-socket operations. The vulnerability is triggered when `curl_easy_pause()` is called from within libcurl's event-based socket callback handler, causing the library to write to memory that has already been freed. This is a memory safety issue that affects applications using libcurl's multi interface with socket callbacks.

• CVE-2026-8458MEDIUM 6.5

  libcurl contains a connection pooling flaw that can cause authenticated requests to reuse the wrong connection. When an application makes multiple requests using Negotiate authentication (a credential delegation mechanism) to the same server but with different service configurations, libcurl's connection reuse logic may incorrectly reuse a cached connection that was authenticated for a different service. This allows subsequent requests to inherit the authentication context of a previous connection, potentially enabling privilege escalation or unauthorized actions within the authenticated session.