curl / Docs / Vulnerability table / 8.20.0 vulnerabilities

Vulnerabilities in curl 8.20.0

Related:
Audits
Changelog
curl CVEs
Vulnerability Disclosure
Vulnerabilities Table

curl version 8.20.0 was released on April 29 2026

It has the following 18 published security problems.

S	Flaw	First	Last
L	CVE-2026-12064: proto-default skips SSH verification	7.81.0	8.20.0
M	CVE-2026-11856: cross-origin Digest auth state leak	7.10.6	8.20.0
L	CVE-2026-11586: WS Auto-PONG memory exhaustion	8.16.0	8.20.0
L	CVE-2026-11564: Native CA trust persist	8.17.0	8.20.0
L	CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop	8.18.0	8.20.0
L	CVE-2026-10536: HTTP/2 stream-dependency tree UAF	7.88.0	8.20.0
L	CVE-2026-9547: SSH improper host validation	7.69.0	8.20.0
L	CVE-2026-9546: sending old referer	8.18.0	8.20.0
L	CVE-2026-9545: exposing HTTP/3 early data	8.11.0	8.20.0
L	CVE-2026-9080: UAF after pause in socket callback	8.13.0	8.20.0
M	CVE-2026-9079: stale proxy password leak	8.8.0	8.20.0
L	CVE-2026-8932: incomplete mTLS config matching in conn reuse	7.7	8.20.0
M	CVE-2026-8927: env-set cross-proxy Digest auth state leak	7.12.0	8.20.0
L	CVE-2026-8926: password leak with netrc and user in URL	8.11.1	8.20.0
M	CVE-2026-8925: SASL double-free	8.15.0	8.20.0
L	CVE-2026-8924: trailing dot domain super cookie	7.46.0	8.20.0
L	CVE-2026-8458: wrong reuse for different services	7.43.0	8.20.0
L	CVE-2026-8286: wrong STARTTLS connection reuse	7.30.0	8.20.0

Further details

CVE data for 8.20.0 provided as JSON.

Changelog for curl 8.20.0

See vulnerability summary for the previous release: 8.19.0 or the subsequent release: 8.21.0