Multiple vulnerabilities in cURL and libcurl (June 24, 2026)

unknownpublic exploitCVE-2026-8926 CVE-2026-11352 CVE-2026-8458 CVE-2026-9546 CVE-2022-27782 CVE-2026-10536

Multiple vulnerabilities have been discovered in cURL and libcurl. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality, and a security policy bypass.

CSIRTS triage

vendor: cURL product: cURL and libcurl Denial of service Information disclosureOther

What: Multiple vulnerabilities allow for denial of service, data confidentiality breaches, and security policy bypass.
Who is affected: Users of cURL and libcurl.
Urgency: Remediation is important as vulnerabilities could lead to significant security issues.
Action: Upgrade to the latest versions of cURL and libcurl.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch cURL and libcurl

Get an email when a new cURL and libcurl advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Avis de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2026-06-24
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0797/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-89260.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-113521.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-84580.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-95460.65% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2022-277822.9% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 86% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-105360.89% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 57% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-89320.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-118560.60% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-115860.86% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 56% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-120640.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-8926	coverage & exploitation status	NVD · CVE.org
CVE-2026-11352	coverage & exploitation status	NVD · CVE.org
CVE-2026-8458	coverage & exploitation status	NVD · CVE.org
CVE-2026-9546	coverage & exploitation status	NVD · CVE.org
CVE-2022-27782	coverage & exploitation status	NVD · CVE.org
CVE-2026-10536	coverage & exploitation status	NVD · CVE.org
CVE-2026-8932	coverage & exploitation status	NVD · CVE.org
CVE-2026-11856	coverage & exploitation status	NVD · CVE.org
CVE-2026-11586	coverage & exploitation status	NVD · CVE.org
CVE-2026-12064	coverage & exploitation status	NVD · CVE.org
CVE-2026-8924	coverage & exploitation status	NVD · CVE.org
CVE-2026-9079	coverage & exploitation status	NVD · CVE.org
CVE-2026-9080	coverage & exploitation status	NVD · CVE.org
CVE-2026-9545	coverage & exploitation status	NVD · CVE.org
CVE-2026-8925	coverage & exploitation status	NVD · CVE.org
CVE-2026-8927	coverage & exploitation status	NVD · CVE.org
CVE-2026-11564	coverage & exploitation status	NVD · CVE.org
CVE-2026-9547	coverage & exploitation status	NVD · CVE.org
CVE-2026-7168	coverage & exploitation status	NVD · CVE.org
CVE-2026-8286	coverage & exploitation status	NVD · CVE.org
CVE-2026-5545	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownUSN-8670-2: curl vulnerabilityubuntu
medium[UPDATE] [medium] cURL: Multiple vulnerabilitiescert-bund
medium[UPDATE] [medium] cURL: Multiple vulnerabilitiescert-bund
unknownUSN-8670-1: curl vulnerabilityubuntu
high[UPDATE] [high] cURL: Multiple vulnerabilitiescert-bund
unknownUSN-8651-1: curl vulnerabilityubuntu
unknownMultiple vulnerabilities in Tenable Security Center (August 14, 2026)cert-fr-avis
unknownMultiple vulnerabilities in IBM products (July 31, 2026)cert-fr-avis
unknownMultiple vulnerabilities in Microsoft Azure Linux (July 15, 2026)cert-fr-avis
mediumCVE-2026-8458: wrong reuse for different servicesmsrc
mediumCVE-2026-8927: env-set cross-proxy Digest auth state leakmsrc
mediumCVE-2026-8925: SASL double-freemsrc