CVE-2026-11586
Harry Sintonen discovered that curl incorrectly handled credentials when following HTTP redirects in conjunction with .netrc files. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-11053) Hiroki Kurosawa discovered that curl incorrectly handled OCSP stapling responses. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-8096) Joshua Rogers discovered that curl had a use-after-free vulnerability when resetting and cleaning up HTTP/2 stream handles. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2026-10536) Quac Tran and Ngoc Hieu discovered that curl incorrectly reused connections when switching authentication methods to the same host. An attacker could possibly use this issue to obtain sensitive information or perform unauthorized actions. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-5545) Osama Hamad discovered that curl incorrectly reused SMB connections when the target share differed between transfers. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-5773) Muhamad Arga Reksapati discovered that curl incorrectly forwarded Digest proxy authentication credentials to a different proxy host. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-7168) It was discovered that curl incorrectly skipped SSH host verification options when using schemeless URLs with --proto-default. An attacker could possibly use this issue to perform machine-in-the-middle attacks. This issue only affected Ubuntu 25.04 and Ubunt
CSIRTS triage
- What
- curl has several vulnerabilities that could lead to information disclosure or denial of service.
- Who is affected
- Affected deployments include Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 24.04 LTS, 25.04, and 25.10.
- Urgency
- Remediation is urgent due to the potential for sensitive information exposure and denial of service.
- Action
- Update to the latest version of curl.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-11586
Get an email if CVE-2026-11586 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.86% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 54% of all EPSS-scored CVEs.
Advisory coverage (4)
- medium[UPDATE] [medium] cURL: Multiple vulnerabilitiescert-bund · 2026-07-10
- unknownUSN-8525-1: curl vulnerabilitiesubuntu · 2026-07-09
- highCVE-2026-11586: By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper …nvd · 2026-07-03
- unknownMultiple vulnerabilities in cURL and libcurl (June 24, 2026)cert-fr-avis · 2026-06-24
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-11586)