[UPDATE] [medium] cURL: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities allow an attacker to bypass security measures, disclose information, or cause denial-of-service or memory corruption.

Who is affected

Deployments of cURL are affected.

Urgency

Remediation is important to prevent potential exploitation of these vulnerabilities.

Action

Update cURL to the latest version.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

medium

Published

2026-09-02

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2052

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-105360.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-113520.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-115640.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-115860.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-118560.60% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-120640.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-90800.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-95450.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-95460.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-95470.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• high[NEW] [high] Hitachi Energy RTU500: Multiple Vulnerabilitiescert-bund
• unknownUSN-8651-1: curl vulnerabilityubuntu
• unknownMultiple vulnerabilities in Tenable Security Center (August 14, 2026)cert-fr-avis
• unknownMultiple vulnerabilities in Microsoft Azure Linux (July 15, 2026)cert-fr-avis
• mediumCVE-2026-11856: cross-origin Digest auth state leakmsrc
• criticalCVE-2026-11564: Native CA trust persistmsrc
• highCVE-2026-11586: WS Auto-PONG memory exhaustionmsrc
• criticalCVE-2026-9547: SSH improper host validationmsrc
• highCVE-2026-12064: proto-default skips SSH verificationmsrc
• highCVE-2026-9545: exposing HTTP/3 early datamsrc
• lowCVE-2026-9080: UAF after pause in socket callbackmsrc
• mediumCVE-2026-10536: HTTP/2 stream-dependency tree UAFmsrc

Recent advisories for cURL

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• medium[UPDATE] [medium] cURL: Multiple vulnerabilitiescert-bund · 2026-09-04
• medium[UPDATE] [medium] cURL: Multiple vulnerabilitiescert-bund · 2026-09-04
• highCVE-2026-52831: Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version …nvd · 2026-09-02
• medium[NEW] [medium] cURL: Multiple vulnerabilitiescert-bund · 2026-09-02
• medium[UPDATE] [medium] cURL: Multiple vulnerabilitiescert-bund · 2026-09-02
• unknownMultiple vulnerabilities in Curl (02 September 2026)cert-fr-avis · 2026-09-02

More from CERT-Bund (BSI) Security Advisories

• medium[NEW] [medium] Langflow: Multiple vulnerabilities2026-09-04
• medium[NEW] [medium] Grafana Enterprise: Multiple vulnerabilities allow gaining user or administrator privileges2026-09-04
• low[NEW] [low] Checkmk: Vulnerability allows Denial of Service2026-09-04
• low[NEW] [low] ImageMagick: Multiple vulnerabilities allow Denial of Service2026-09-04
• critical[NEW] [critical] vm2: Multiple vulnerabilities allow code execution2026-09-04