Vulnerability-Lookup

CVE-2026-8926 (GCVE-0-2026-8926)

Vulnerability from cvelistv5 – Published: 2026-07-03 06:15 – Updated: 2026-09-15 06:03

Title

password leak with netrc and user in URL

Summary

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-06 17:01 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

curl redhat root

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-8926.json
https://curl.se/docs/CVE-2026-8926.html
https://hackerone.com/reports/3735184

Impacted products

3 products

Vendor	Product	Version	CPE status
curl	curl	Affected: 8.11.1 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.1 (semver)	guessed
curl	curl	Affected: e9b9bbac22c26cf67316fa8e6c6b9e831af31949 , < 4ae1d7cc2643e4773a136395f12bc02fc6867854 (git)	guessed
curl	curl	Affected: 8.20.0 Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1	guessed

Credits

Joshua Rogers (Aisle Research) Stefan Eissing

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8926",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T17:01:57.524535Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T17:02:33.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3735184"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.1",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "4ae1d7cc2643e4773a136395f12bc02fc6867854",
              "status": "affected",
              "version": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.20.0"
            },
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joshua Rogers (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stefan Eissing"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:03:23.777Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-8926.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-8926.html"
        },
        {
          "url": "https://hackerone.com/reports/3735184"
        }
      ],
      "title": "password leak with netrc and user in URL",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "8.11.1"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.1"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949"
                  },
                  {
                    "fixed": "4ae1d7cc2643e4773a136395f12bc02fc6867854"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.20.0",
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-8926"
        ],
        "credits": [
          {
            "name": "Joshua Rogers (Aisle Research)",
            "type": "finder"
          },
          {
            "name": "Stefan Eissing",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Insufficiently Protected Credentials",
            "id": "CWE-522"
          },
          "URL": "https://curl.se/docs/CVE-2026-8926.json",
          "affects": "both",
          "issue": "https://hackerone.com/reports/3735184",
          "last_affected": "8.20.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2026-8926.html"
        },
        "details": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.",
        "id": "CURL-CVE-2026-8926",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-06-24T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "password leak with netrc and user in URL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-8926",
    "datePublished": "2026-07-03T06:15:45.735Z",
    "dateReserved": "2026-05-19T08:11:58.393Z",
    "dateUpdated": "2026-09-15T06:03:23.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-8926",
      "date": "2026-09-20",
      "epss": "0.00444",
      "percentile": "0.3797"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-10T14:40:29.000Z",
      "cve": "CVE-2026-8926",
      "id": "msrc_CVE-2026-8926",
      "initial_release_date": "2026-07-02T00:00:00.000Z",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "password leak with netrc and user in URL",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-8926.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThan": "8.14.2",
                    "status": "affected",
                    "version": "8.11.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.16.1",
                    "status": "affected",
                    "version": "8.15.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.20.1",
                    "status": "affected",
                    "version": "8.17.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "repo": "https://github.com/curl/curl.git",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThan": "4ae1d7cc2643e4773a136395f12bc02fc6867854",
                    "status": "affected",
                    "version": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.20.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.19.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.18.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.17.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.16.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.15.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.14.1"
                  },
                  {
                    "status": "affected",
                    "version": "8.14.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.13.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.12.1"
                  },
                  {
                    "status": "affected",
                    "version": "8.12.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.11.1"
                  }
                ]
              }
            ],
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C3AD1A6E-F3DD-4151-9602-669ADAF00525",
                    "versionEndExcluding": "8.21.0",
                    "versionStartIncluding": "8.11.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."
          }
        ],
        "id": "CVE-2026-8926",
        "lastModified": "2026-09-15T07:16:32.980",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-8926",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T17:01:57.524535Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-03T07:16:25.037",
        "references": [
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://curl.se/docs/CVE-2026-8926.html"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://curl.se/docs/CVE-2026-8926.json"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://hackerone.com/reports/3735184"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://hackerone.com/reports/3735184"
          }
        ],
        "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-522"
              }
            ],
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-522"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T12:36:51+00:00",
      "cve": "CVE-2026-8926",
      "id": "CVE-2026-8926",
      "initial_release_date": "2026-07-03T06:15:45.735000+00:00",
      "product_status:fixed": "7",
      "product_status:known_affected": "9",
      "product_status:known_not_affected": "19",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "curl: curl: Information disclosure via incorrect .netrc password lookup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8926.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T01:00:53Z",
      "cve": "CVE-2026-8926",
      "id": "CVE-2026-8926",
      "initial_release_date": "2026-07-10T03:20:26Z",
      "product_status:known_affected": "478",
      "product_status:known_not_affected": "50",
      "product_status:recommended": "67",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-8926",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-8926.json",
      "version": "14"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 9.1,
                  "baseSeverity": "CRITICAL",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-8926",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-06T17:01:57.524535Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-06T17:02:29.139Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://hackerone.com/reports/3735184"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "curl",
              "vendor": "curl",
              "versions": [
                {
                  "lessThan": "8.14.2",
                  "status": "affected",
                  "version": "8.11.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.16.1",
                  "status": "affected",
                  "version": "8.15.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.20.1",
                  "status": "affected",
                  "version": "8.17.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "curl",
              "repo": "https://github.com/curl/curl.git",
              "vendor": "curl",
              "versions": [
                {
                  "lessThan": "4ae1d7cc2643e4773a136395f12bc02fc6867854",
                  "status": "affected",
                  "version": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "curl",
              "vendor": "curl",
              "versions": [
                {
                  "status": "affected",
                  "version": "8.20.0"
                },
                {
                  "status": "affected",
                  "version": "8.19.0"
                },
                {
                  "status": "affected",
                  "version": "8.18.0"
                },
                {
                  "status": "affected",
                  "version": "8.17.0"
                },
                {
                  "status": "affected",
                  "version": "8.16.0"
                },
                {
                  "status": "affected",
                  "version": "8.15.0"
                },
                {
                  "status": "affected",
                  "version": "8.14.1"
                },
                {
                  "status": "affected",
                  "version": "8.14.0"
                },
                {
                  "status": "affected",
                  "version": "8.13.0"
                },
                {
                  "status": "affected",
                  "version": "8.12.1"
                },
                {
                  "status": "affected",
                  "version": "8.12.0"
                },
                {
                  "status": "affected",
                  "version": "8.11.1"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Joshua Rogers (Aisle Research)"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Stefan Eissing"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-522",
                  "description": "Insufficiently Protected Credentials",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T06:03:23.777Z",
            "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "shortName": "curl"
          },
          "references": [
            {
              "url": "https://curl.se/docs/CVE-2026-8926.json"
            },
            {
              "url": "https://curl.se/docs/CVE-2026-8926.html"
            },
            {
              "url": "https://hackerone.com/reports/3735184"
            }
          ],
          "title": "password leak with netrc and user in URL",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_osv": {
            "affected": [
              {
                "ranges": [
                  {
                    "events": [
                      {
                        "introduced": "8.11.1"
                      },
                      {
                        "fixed": "8.14.2"
                      },
                      {
                        "introduced": "8.15.0"
                      },
                      {
                        "fixed": "8.16.1"
                      },
                      {
                        "introduced": "8.17.0"
                      },
                      {
                        "fixed": "8.20.1"
                      }
                    ],
                    "type": "SEMVER"
                  },
                  {
                    "events": [
                      {
                        "introduced": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949"
                      },
                      {
                        "fixed": "4ae1d7cc2643e4773a136395f12bc02fc6867854"
                      }
                    ],
                    "repo": "https://github.com/curl/curl.git",
                    "type": "GIT"
                  }
                ],
                "versions": [
                  "8.20.0",
                  "8.19.0",
                  "8.18.0",
                  "8.17.0",
                  "8.16.0",
                  "8.15.0",
                  "8.14.1",
                  "8.14.0",
                  "8.13.0",
                  "8.12.1",
                  "8.12.0",
                  "8.11.1"
                ]
              }
            ],
            "aliases": [
              "CVE-2026-8926"
            ],
            "credits": [
              {
                "name": "Joshua Rogers (Aisle Research)",
                "type": "finder"
              },
              {
                "name": "Stefan Eissing",
                "type": "remediation developer"
              }
            ],
            "database_specific": {
              "CWE": {
                "desc": "Insufficiently Protected Credentials",
                "id": "CWE-522"
              },
              "URL": "https://curl.se/docs/CVE-2026-8926.json",
              "affects": "both",
              "issue": "https://hackerone.com/reports/3735184",
              "last_affected": "8.20.0",
              "package": "curl",
              "severity": "Low",
              "www": "https://curl.se/docs/CVE-2026-8926.html"
            },
            "details": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.",
            "id": "CURL-CVE-2026-8926",
            "modified": "2026-09-07T10:34:51.00Z",
            "published": "2026-06-24T08:00:00.00Z",
            "schema_version": "1.5.0",
            "summary": "password leak with netrc and user in URL"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "assignerShortName": "curl",
        "cveId": "CVE-2026-8926",
        "datePublished": "2026-07-03T06:15:45.735Z",
        "dateReserved": "2026-05-19T08:11:58.393Z",
        "dateUpdated": "2026-09-15T06:03:23.777Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BELL-CVE-2026-8926 (CVE-2026-8926)

Vulnerability from osv_bellsoft – Published: 2026-07-02 17:40 – Updated: 2026-07-06 18:03 – Source website

Severity

9.1 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

URL

Type

https://docs.bell-sw.com/security/cves/CVE-2026-8926

ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpaquita:23",
        "name": "curl",
        "purl": "pkg:apk/alpaquita/curl?arch=source\u0026distro=23"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.0-r2"
            },
            {
              "fixed": "8.21.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:25",
        "name": "curl",
        "purl": "pkg:apk/alpaquita/curl?arch=source\u0026distro=25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.14.0-r1"
            },
            {
              "fixed": "8.21.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:stream",
        "name": "curl",
        "purl": "pkg:apk/alpaquita/curl?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.2-r0"
            },
            {
              "fixed": "8.21.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "BellSoft Hardened Containers:stream",
        "name": "curl",
        "purl": "pkg:apk/bellsoft-hardened-containers/curl?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.2-r0"
            },
            {
              "fixed": "8.21.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "id": "BELL-CVE-2026-8926",
  "modified": "2026-07-06T18:03:30.508467Z",
  "published": "2026-07-02T17:40:10.581494Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://docs.bell-sw.com/security/cves/CVE-2026-8926"
    }
  ],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-8926"
  ]
}

CERTFR-2026-AVI-0797

Vulnerability from certfr_avis - Published: 2026-06-24 - Updated: 2026-06-24

De multiples vulnérabilités ont été découvertes dans cURL et libcurl. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Curl	cURL et libcurl	cURL et libcurl versions antérieures à 8.21.0

References

Title

Publication Time

CERTFR-2026-AVI-0873

Vulnerability from certfr_avis - Published: 2026-07-15 - Updated: 2026-07-15

De multiples vulnérabilités ont été découvertes dans Microsoft Azure Linux. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Microsoft	Azure Linux	azl3 libXfont2 2.0.6-1 versions antérieures à 2.0.8-1
Microsoft	Azure Linux	azl3 telegraf 1.31.0-23 versions antérieures à 1.31.0-25
Microsoft	Azure Linux	azl3 clamav 1.5.2-3 versions antérieures à 1.5.3-1
Microsoft	Azure Linux	azl3 glib 2.78.6-9 versions antérieures à 2.78.6-10
Microsoft	Azure Linux	azl3 mtr 0.95-3 versions antérieures à 0.95-4
Microsoft	Azure Linux	azl3 xorg-x11-server-Xwayland 24.1.12-1 versions antérieures à 24.1.13-1
Microsoft	Azure Linux	azl3 python-msgpack 1.0.5-2 versions antérieures à 1.0.5-3
Microsoft	Azure Linux	azl3 curl 8.11.1-9 versions antérieures à 8.11.1-10
Microsoft	Azure Linux	azl3 erlang 26.2.5.21-2 versions antérieures à 26.2.5.21-3
Microsoft	Azure Linux	azl3 openssh 9.8p1-8 versions antérieures à 9.8p1-9
Microsoft	Azure Linux	azl3 python-setuptools 69.0.3-5 versions antérieures à 69.0.3-6
Microsoft	Azure Linux	azl3 nodejs 24.17.0-1 versions antérieures à 24.17.0-2
Microsoft	Azure Linux	azl3 vim 9.2.0735-1 versions antérieures à 9.2.0782-1
Microsoft	Azure Linux	azl3 keras 3.3.3-7 versions antérieures à 3.3.3-8
Microsoft	Azure Linux	azl3 perl-DBI 1.643-5 versions antérieures à 1.650-1

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft Azure Linux CVE-2026-58013	2026-07-01	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-9079	2026-07-04	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-56001	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-20243	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-60001	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-20214	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-8927	2026-07-04	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-20216	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-54908	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-58011	2026-07-01	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-58012	2026-07-01	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-8926	2026-07-04	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-59997	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-56002	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-60002	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-8932	2026-07-04	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-57585	2026-07-03	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-12064	2026-07-04	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-20215	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-56000	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-56003	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-14380	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-58014	2026-07-01	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-8286	2026-07-04	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-58015	2026-07-01	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-8458	2026-07-04	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-11525	2026-06-27	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-59996	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-10536	2026-07-04	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-20213	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-59999	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-59995	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-20244	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-14740	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-14461	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-58016	2026-07-01	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-12480	2026-07-07	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-58010	2026-07-01	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-59856	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-60000	2026-07-09	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-14739	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-54886	2026-07-07	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-59890	2026-07-11	vendor-advisory
Bulletin de sécurité Microsoft Azure Linux CVE-2026-20217	2026-07-11	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "azl3 libXfont2 2.0.6-1 versions ant\u00e9rieures \u00e0 2.0.8-1",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 telegraf 1.31.0-23 versions ant\u00e9rieures \u00e0 1.31.0-25",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 clamav 1.5.2-3 versions ant\u00e9rieures \u00e0 1.5.3-1",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 glib 2.78.6-9 versions ant\u00e9rieures \u00e0 2.78.6-10",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 mtr 0.95-3 versions ant\u00e9rieures \u00e0 0.95-4",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 xorg-x11-server-Xwayland 24.1.12-1 versions ant\u00e9rieures \u00e0 24.1.13-1",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 python-msgpack 1.0.5-2 versions ant\u00e9rieures \u00e0 1.0.5-3",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 curl 8.11.1-9 versions ant\u00e9rieures \u00e0 8.11.1-10",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 erlang 26.2.5.21-2 versions ant\u00e9rieures \u00e0 26.2.5.21-3",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 openssh 9.8p1-8 versions ant\u00e9rieures \u00e0 9.8p1-9",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 python-setuptools 69.0.3-5 versions ant\u00e9rieures \u00e0 69.0.3-6",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 nodejs 24.17.0-1 versions ant\u00e9rieures \u00e0 24.17.0-2",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 vim 9.2.0735-1 versions ant\u00e9rieures \u00e0 9.2.0782-1",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 keras 3.3.3-7 versions ant\u00e9rieures \u00e0 3.3.3-8",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 perl-DBI 1.643-5 versions ant\u00e9rieures \u00e0 1.650-1",
      "product": {
        "name": "Azure Linux",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-14380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14380"
    },
    {
      "name": "CVE-2026-14461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14461"
    },
    {
      "name": "CVE-2026-59996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59996"
    },
    {
      "name": "CVE-2026-59995",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59995"
    },
    {
      "name": "CVE-2026-59999",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59999"
    },
    {
      "name": "CVE-2026-20216",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20216"
    },
    {
      "name": "CVE-2026-58013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58013"
    },
    {
      "name": "CVE-2026-8926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8926"
    },
    {
      "name": "CVE-2026-20243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20243"
    },
    {
      "name": "CVE-2026-8458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8458"
    },
    {
      "name": "CVE-2026-14739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14739"
    },
    {
      "name": "CVE-2026-58015",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58015"
    },
    {
      "name": "CVE-2026-56000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56000"
    },
    {
      "name": "CVE-2026-58014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58014"
    },
    {
      "name": "CVE-2026-20215",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20215"
    },
    {
      "name": "CVE-2026-58012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58012"
    },
    {
      "name": "CVE-2026-59890",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59890"
    },
    {
      "name": "CVE-2026-10536",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10536"
    },
    {
      "name": "CVE-2026-20213",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20213"
    },
    {
      "name": "CVE-2026-8932",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8932"
    },
    {
      "name": "CVE-2026-11525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11525"
    },
    {
      "name": "CVE-2026-59997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59997"
    },
    {
      "name": "CVE-2026-58010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58010"
    },
    {
      "name": "CVE-2026-12064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12064"
    },
    {
      "name": "CVE-2026-12480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12480"
    },
    {
      "name": "CVE-2026-20214",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20214"
    },
    {
      "name": "CVE-2026-60002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60002"
    },
    {
      "name": "CVE-2026-9079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9079"
    },
    {
      "name": "CVE-2026-56003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56003"
    },
    {
      "name": "CVE-2026-59856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59856"
    },
    {
      "name": "CVE-2026-20217",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20217"
    },
    {
      "name": "CVE-2026-58011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58011"
    },
    {
      "name": "CVE-2026-58016",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58016"
    },
    {
      "name": "CVE-2026-60001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60001"
    },
    {
      "name": "CVE-2026-14740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14740"
    },
    {
      "name": "CVE-2026-20244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20244"
    },
    {
      "name": "CVE-2026-57585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57585"
    },
    {
      "name": "CVE-2026-8927",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8927"
    },
    {
      "name": "CVE-2026-60000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60000"
    },
    {
      "name": "CVE-2026-54908",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54908"
    },
    {
      "name": "CVE-2026-56002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56002"
    },
    {
      "name": "CVE-2026-54886",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54886"
    },
    {
      "name": "CVE-2026-56001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56001"
    },
    {
      "name": "CVE-2026-8286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
    }
  ],
  "initial_release_date": "2026-07-15T00:00:00",
  "last_revision_date": "2026-07-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0873",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-07-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Azure Linux. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure Linux",
  "vendor_advisories": [
    {
      "published_at": "2026-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-58013",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58013"
    },
    {
      "published_at": "2026-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-9079",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-9079"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-56001",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56001"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-20243",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20243"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-60001",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-60001"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-20214",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20214"
    },
    {
      "published_at": "2026-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-8927",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8927"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-20216",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20216"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-54908",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54908"
    },
    {
      "published_at": "2026-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-58011",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58011"
    },
    {
      "published_at": "2026-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-58012",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58012"
    },
    {
      "published_at": "2026-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-8926",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8926"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-59997",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59997"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-56002",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56002"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-60002",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-60002"
    },
    {
      "published_at": "2026-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-8932",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8932"
    },
    {
      "published_at": "2026-07-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-57585",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57585"
    },
    {
      "published_at": "2026-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-12064",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12064"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-20215",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20215"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-56000",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56000"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-56003",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56003"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-14380",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14380"
    },
    {
      "published_at": "2026-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-58014",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58014"
    },
    {
      "published_at": "2026-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-8286",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8286"
    },
    {
      "published_at": "2026-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-58015",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58015"
    },
    {
      "published_at": "2026-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-8458",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8458"
    },
    {
      "published_at": "2026-06-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-11525",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-11525"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-59996",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59996"
    },
    {
      "published_at": "2026-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-10536",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-10536"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-20213",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20213"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-59999",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59999"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-59995",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59995"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-20244",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20244"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-14740",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14740"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-14461",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14461"
    },
    {
      "published_at": "2026-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-58016",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58016"
    },
    {
      "published_at": "2026-07-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-12480",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12480"
    },
    {
      "published_at": "2026-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-58010",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58010"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-59856",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59856"
    },
    {
      "published_at": "2026-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-60000",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-60000"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-14739",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14739"
    },
    {
      "published_at": "2026-07-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-54886",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54886"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-59890",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59890"
    },
    {
      "published_at": "2026-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-20217",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20217"
    }
  ]
}

FKIE_CVE-2026-8926

Vulnerability from fkie_nvd - Published: 2026-07-03 07:16 - Updated: 2026-09-15 07:16

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

URL	Tags
2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2026-8926.html	Patch, Vendor Advisory
2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2026-8926.json	Vendor Advisory
2499f714-1537-4658-8207-48ae4bb9eae9	https://hackerone.com/reports/3735184	Exploit, Issue Tracking, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://hackerone.com/reports/3735184	Exploit, Issue Tracking, Third Party Advisory

Impacted products

	Vendor	Product	Version
	haxx	curl	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.1",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "4ae1d7cc2643e4773a136395f12bc02fc6867854",
              "status": "affected",
              "version": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.20.0"
            },
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            }
          ]
        }
      ],
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3AD1A6E-F3DD-4151-9602-669ADAF00525",
              "versionEndExcluding": "8.21.0",
              "versionStartIncluding": "8.11.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."
    }
  ],
  "id": "CVE-2026-8926",
  "lastModified": "2026-09-15T07:16:32.980",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-8926",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-06T17:01:57.524535Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-03T07:16:25.037",
  "references": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://curl.se/docs/CVE-2026-8926.html"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://curl.se/docs/CVE-2026-8926.json"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/3735184"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/3735184"
    }
  ],
  "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-VW2X-3W8J-RQ82

Vulnerability from github – Published: 2026-07-03 09:31 – Updated: 2026-07-06 18:30

Details

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like https://user@example.com/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-8926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-03T07:16:25Z",
    "severity": "CRITICAL"
  },
  "details": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username(without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.",
  "id": "GHSA-vw2x-3w8j-rq82",
  "modified": "2026-07-06T18:30:47Z",
  "published": "2026-07-03T09:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8926"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3735184"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2026-8926.html"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2026-8926.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-8926

Vulnerability from csaf_microsoft - Published: 2026-07-02 00:00 - Updated: 2026-07-12 14:49

Summary

password leak with netrc and user in URL

Scope

1 vulnerability in this advisory, including CVE-2026-8926.

CVE-2026-8926

Fixed: 1 product Known affected: 1 product Known not affected: 3 products

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

OESA-2026-3170 (CVE-2026-8926)

Vulnerability from osv_openeuler – Published: 2026-07-24 11:12 – Updated: 2026-08-06 11:12 – Source website

Summary

curl security update

Details

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like `https://(CVE-2026-8926)

Severity

4.8 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-8926	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-8.4.0-33.oe2403sp4.aarch64.rpm",
          "curl-debuginfo-8.4.0-33.oe2403sp4.aarch64.rpm",
          "curl-debugsource-8.4.0-33.oe2403sp4.aarch64.rpm",
          "libcurl-8.4.0-33.oe2403sp4.aarch64.rpm",
          "libcurl-devel-8.4.0-33.oe2403sp4.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-8.4.0-33.oe2403sp4.noarch.rpm"
        ],
        "src": [
          "curl-8.4.0-33.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "curl-8.4.0-33.oe2403sp4.x86_64.rpm",
          "curl-debuginfo-8.4.0-33.oe2403sp4.x86_64.rpm",
          "curl-debugsource-8.4.0-33.oe2403sp4.x86_64.rpm",
          "libcurl-8.4.0-33.oe2403sp4.x86_64.rpm",
          "libcurl-devel-8.4.0-33.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.4.0-33.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nWhen asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username(without a password), like\n`https://(CVE-2026-8926)",
  "id": "OESA-2026-3170",
  "modified": "2026-08-06T11:12:02Z",
  "published": "2026-07-24T11:12:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3170"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8926"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "curl security update",
  "upstream": [
    "CVE-2026-8926"
  ]
}

OESA-2026-3171 (CVE-2026-8926)

Vulnerability from osv_openeuler – Published: 2026-07-24 11:12 – Updated: 2026-08-06 11:12 – Source website

Summary

curl security update

Details

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like `https://(CVE-2026-8926)

Severity

4.8 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-8926	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-8.4.0-33.oe2403sp1.aarch64.rpm",
          "curl-debuginfo-8.4.0-33.oe2403sp1.aarch64.rpm",
          "curl-debugsource-8.4.0-33.oe2403sp1.aarch64.rpm",
          "libcurl-8.4.0-33.oe2403sp1.aarch64.rpm",
          "libcurl-devel-8.4.0-33.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-8.4.0-33.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "curl-8.4.0-33.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "curl-8.4.0-33.oe2403sp1.x86_64.rpm",
          "curl-debuginfo-8.4.0-33.oe2403sp1.x86_64.rpm",
          "curl-debugsource-8.4.0-33.oe2403sp1.x86_64.rpm",
          "libcurl-8.4.0-33.oe2403sp1.x86_64.rpm",
          "libcurl-devel-8.4.0-33.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.4.0-33.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nWhen asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username(without a password), like\n`https://(CVE-2026-8926)",
  "id": "OESA-2026-3171",
  "modified": "2026-08-06T11:12:02Z",
  "published": "2026-07-24T11:12:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3171"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8926"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "curl security update",
  "upstream": [
    "CVE-2026-8926"
  ]
}

OESA-2026-3172 (CVE-2026-8926)

Vulnerability from osv_openeuler – Published: 2026-07-24 11:12 – Updated: 2026-08-06 11:12 – Source website

Summary

curl security update

Details

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like `https://(CVE-2026-8926)

Severity

4.8 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-8926	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-8.4.0-33.oe2403sp3.aarch64.rpm",
          "curl-debuginfo-8.4.0-33.oe2403sp3.aarch64.rpm",
          "curl-debugsource-8.4.0-33.oe2403sp3.aarch64.rpm",
          "libcurl-8.4.0-33.oe2403sp3.aarch64.rpm",
          "libcurl-devel-8.4.0-33.oe2403sp3.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-8.4.0-33.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "curl-8.4.0-33.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "curl-8.4.0-33.oe2403sp3.x86_64.rpm",
          "curl-debuginfo-8.4.0-33.oe2403sp3.x86_64.rpm",
          "curl-debugsource-8.4.0-33.oe2403sp3.x86_64.rpm",
          "libcurl-8.4.0-33.oe2403sp3.x86_64.rpm",
          "libcurl-devel-8.4.0-33.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.4.0-33.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nWhen asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username(without a password), like\n`https://(CVE-2026-8926)",
  "id": "OESA-2026-3172",
  "modified": "2026-08-06T11:12:03Z",
  "published": "2026-07-24T11:12:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3172"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8926"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "curl security update",
  "upstream": [
    "CVE-2026-8926"
  ]
}

OPENSUSE-SU-2026:11230-1

Vulnerability from csaf_opensuse - Published: 2026-07-09 00:00 - Updated: 2026-09-17 17:13

Summary

curl-8.21.0-1.1 on GA media

Severity

Moderate

Scope

18 vulnerabilities in this advisory, including CVE-2026-8926.

CVE-2026-8926

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Recommended: 36 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-8926 (GCVE-0-2026-8926)

BELL-CVE-2026-8926 (CVE-2026-8926)

CERTFR-2026-AVI-0797

Solutions

CERTFR-2026-AVI-0873

Solutions

FKIE_CVE-2026-8926

GHSA-VW2X-3W8J-RQ82

MSRC_CVE-2026-8926

OESA-2026-3170 (CVE-2026-8926)

OESA-2026-3171 (CVE-2026-8926)

OESA-2026-3172 (CVE-2026-8926)

OPENSUSE-SU-2026:11230-1

Tags

Sightings

Nomenclature

Related by attack behaviour