https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 17:14:20 +0000 https://vulnerability.circl.lu/vuln/cve-2025-14017 <p><strong>Affected:</strong> curl</p> <p>When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.</p> <p>Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.</p> <p><strong>Affected:</strong> curl</p> <p>When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.</p> <p>Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.</p> https://vulnerability.circl.lu/vuln/cve-2025-14017 https://vulnerability.circl.lu/vuln/usn-8062-1 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: curl, Ubuntu:24.04:LTS: curl, Ubuntu:25.10: curl</p> <p>It was discovered that curl incorrectly handled cookies when redirected from secure to insecure connections. An attacker could possibly use this issue to cause a denial of service, or obtain sensitive information. This issue only affected Ubuntu 25.10. (CVE-2025-9086)</p> <p>Calvin Ruocco discovered that curl did not properly handle WebSocket communications under certain circumstances. A malicious server could possibly use this issue to poison proxy caches with malicious content. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-10148)</p> <p>Stanislav Fort discovered that wcurl did not properly handle URLs with certain encoded characters. If a user were tricked into processing a specially crafted URL, an attacker could possibly use this issue to write files outside the intended directory. This issue only affected Ubuntu 25.10. (CVE-2025-11563)</p> <p>Stanislav Fort discovered that curl did not properly validate pinned public keys under certain circumstances. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 25.10.(CVE-2025-13034)</p> <p>Stanislav Fort discovered that curl did not properly manage TLS options when performing LDAP over TLS transfers in multi-threaded environments. Under certain circumstances, certificate verification could be unintentionally and unknowingly disabled. (CVE-2025-14017)</p> <p>It was discovered that curl incorrectly handled Oauth2 bearer tokens when following redirects. A remote attac…</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: curl, Ubuntu:24.04:LTS: curl, Ubuntu:25.10: curl</p> <p>It was discovered that curl incorrectly handled cookies when redirected from secure to insecure connections. An attacker could possibly use this issue to cause a denial of service, or obtain sensitive information. This issue only affected Ubuntu 25.10. (CVE-2025-9086)</p> <p>Calvin Ruocco discovered that curl did not properly handle WebSocket communications under certain circumstances. A malicious server could possibly use this issue to poison proxy caches with malicious content. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-10148)</p> <p>Stanislav Fort discovered that wcurl did not properly handle URLs with certain encoded characters. If a user were tricked into processing a specially crafted URL, an attacker could possibly use this issue to write files outside the intended directory. This issue only affected Ubuntu 25.10. (CVE-2025-11563)</p> <p>Stanislav Fort discovered that curl did not properly validate pinned public keys under certain circumstances. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 25.10.(CVE-2025-13034)</p> <p>Stanislav Fort discovered that curl did not properly manage TLS options when performing LDAP over TLS transfers in multi-threaded environments. Under certain circumstances, certificate verification could be unintentionally and unknowingly disabled. (CVE-2025-14017)</p> <p>It was discovered that curl incorrectly handled Oauth2 bearer tokens when following redirects. A remote attac…</p> https://vulnerability.circl.lu/vuln/usn-8062-1