CVE-Katalog

CVE-2026-94266

curl vulnerabilities

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

Schweregrad: Medium · CVSS 4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: Oct 13, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.24% · Oct 27, 2026

Projects and upstream resources

[curl][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	curl	`8.23.0-1`	Fixed	[CVE-2026-94266]
Debiansid	curl	`8.23.0~rc2-1`	FixedDistribution-reported fixed boundary	[CVE-2026-94266]

Showing 2 fix observations. All 123 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Alpine3.23	curl	`8.23.0-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2026-94266]Oct 25, 2026, 4:30:02 PM UTC
Alpine3.24	curl	`8.23.0-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2026-94266]Oct 25, 2026, 4:30:02 PM UTC
Debianbookworm	curl	Not reported	AffectedDistribution reports no fix	[CVE-2026-94266]
Debianbookworm	curl	`7.88.1-10+deb12u15`	Affected	[CVE-2026-94266]
Debianbookworm-security	curl	`7.88.1-10+deb12u5`	Affected	[CVE-2026-94266]
Debianforky	curl	Not reported	AffectedDistribution reports no fix	[CVE-2026-94266]
Debianforky	curl	`8.22.0-1`	Affected	[CVE-2026-94266]
Debiansid	curl	`8.23.0-1`	Fixed	[CVE-2026-94266]
Debiansid	curl	`8.23.0~rc2-1`	FixedDistribution-reported fixed boundary	[CVE-2026-94266]
Debiantrixie	curl	Not reported	AffectedDistribution reports no fix	[CVE-2026-94266]
Debiantrixie	curl	`8.14.1-2+deb13u5`	Affected	[CVE-2026-94266]
Debiantrixie-security	curl	`8.14.1-2+deb13u7`	Affected	[CVE-2026-94266]
Ubuntu22.04	curl	`7.74.0-1.3ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.74.0-1.3ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.80.0-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.10`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.11`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.13`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.14`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.15`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.16`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.17`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.18`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.19`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.20`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.21`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.22`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.23`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.24`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.25`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.26`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.27`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.29`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.30`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.6`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.7`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu22.04	curl	`7.81.0-1ubuntu1.8`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.2.1-1ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.2.1-1ubuntu3.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.4.0-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.10`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.11`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.12`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.13`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.15`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.16`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.6`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.7`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.8`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu10.9`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu8`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu24.04	curl	`8.5.0-2ubuntu9`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.14.1-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.17.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.18.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.18.0-1ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.18.0-1ubuntu2.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.18.0-1ubuntu2.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.18.0-1ubuntu2.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.18.0-1ubuntu2.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.18.0-1ubuntu2.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.18.0-1ubuntu2.7`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.04	curl	`8.18.0-1ubuntu2.8`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.10	curl	`8.18.0-1ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.10	curl	`8.20.0-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.10	curl	`8.20.0-2ubuntu10`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.10	curl	`8.20.0-2ubuntu11`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.10	curl	`8.20.0-2ubuntu11.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntu26.10	curl	`8.20.0-2ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntunoble	curl	`8.5.0-2ubuntu10.16`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	libcurl3t64-gnutls	`8.5.0-2ubuntu10.16`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	libcurl4-doc	`8.5.0-2ubuntu10.16`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	libcurl4-gnutls-dev	`8.5.0-2ubuntu10.16`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	libcurl4-openssl-dev	`8.5.0-2ubuntu10.16`	UnknownSource applicability is not established	Provider not reported
Ubuntunoble	libcurl4t64	`8.5.0-2ubuntu10.16`	UnknownSource applicability is not established	Provider not reported
Ubuntupro	curl	`7.65.3-1ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.65.3-1ubuntu4`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.66.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.67.0-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.10`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.11`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.12`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.13`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.14`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.15`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.16`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.18`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.19`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.20`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.21`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.22`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.23`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.24`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.25`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.25+esm10`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.25+esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.25+esm3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.25+esm4`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.25+esm5`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.25+esm6`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.25+esm7`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.25+esm9`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.6`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC
Ubuntupro	curl	`7.68.0-1ubuntu2.7`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-94266]Oct 28, 2026, 8:17:49 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "curl",
      "status": "fixed",
      "release": "sid",
      "version": "8.23.0-1"
    },
    {
      "name": "curl",
      "status": "vulnerable",
      "release": "forky",
      "version": "8.22.0-1"
    },
    {
      "name": "curl",
      "status": "vulnerable",
      "release": "trixie",
      "version": "8.14.1-2+deb13u5"
    },
    {
      "name": "curl",
      "status": "vulnerable",
      "release": "trixie-security",
      "version": "8.14.1-2+deb13u7"
    },
    {
      "name": "curl",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "7.88.1-10+deb12u15"
    },
    {
      "name": "curl",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "7.88.1-10+deb12u5"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "curl",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "8.23.0~rc2-1"
    },
    {
      "bug": null,
      "name": "curl",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "curl",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "curl",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "curl",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.5.0-2ubuntu10.16",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.5.0-2ubuntu10.16",
      "applicability_unknown": true
    },
    {
      "name": "libcurl3t64-gnutls",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.5.0-2ubuntu10.16",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.5.0-2ubuntu10.16",
      "applicability_unknown": true
    },
    {
      "name": "libcurl4-doc",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.5.0-2ubuntu10.16",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.5.0-2ubuntu10.16",
      "applicability_unknown": true
    },
    {
      "name": "libcurl4-gnutls-dev",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.5.0-2ubuntu10.16",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.5.0-2ubuntu10.16",
      "applicability_unknown": true
    },
    {
      "name": "libcurl4-openssl-dev",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.5.0-2ubuntu10.16",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.5.0-2ubuntu10.16",
      "applicability_unknown": true
    },
    {
      "name": "libcurl4t64",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.5.0-2ubuntu10.16",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.5.0-2ubuntu10.16",
      "applicability_unknown": true
    },
    {
      "name": "curl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.68.0-1ubuntu2.25+esm10"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "7.65.3-1ubuntu3",
        "7.65.3-1ubuntu4",
        "7.66.0-1ubuntu1",
        "7.67.0-2ubuntu1",
        "7.68.0-1ubuntu1",
        "7.68.0-1ubuntu2",
        "7.68.0-1ubuntu2.1",
        "7.68.0-1ubuntu2.2",
        "7.68.0-1ubuntu2.4",
        "7.68.0-1ubuntu2.5",
        "7.68.0-1ubuntu2.6",
        "7.68.0-1ubuntu2.7",
        "7.68.0-1ubuntu2.10",
        "7.68.0-1ubuntu2.11",
        "7.68.0-1ubuntu2.12",
        "7.68.0-1ubuntu2.13",
        "7.68.0-1ubuntu2.14",
        "7.68.0-1ubuntu2.15",
        "7.68.0-1ubuntu2.16",
        "7.68.0-1ubuntu2.18",
        "7.68.0-1ubuntu2.19",
        "7.68.0-1ubuntu2.20",
        "7.68.0-1ubuntu2.21",
        "7.68.0-1ubuntu2.22",
        "7.68.0-1ubuntu2.23",
        "7.68.0-1ubuntu2.24",
        "7.68.0-1ubuntu2.25",
        "7.68.0-1ubuntu2.25+esm2",
        "7.68.0-1ubuntu2.25+esm3",
        "7.68.0-1ubuntu2.25+esm4",
        "7.68.0-1ubuntu2.25+esm5",
        "7.68.0-1ubuntu2.25+esm6",
        "7.68.0-1ubuntu2.25+esm7",
        "7.68.0-1ubuntu2.25+esm9"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-94266",
      "fixed_version": "7.68.0-1ubuntu2.25+esm10",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-94266",
      "provider_updated_at": "2026-10-28T20:17:49.030056500Z",
      "applicability_unknown": true
    },
    {
      "name": "curl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.81.0-1ubuntu1.30"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "7.74.0-1.3ubuntu2",
        "7.74.0-1.3ubuntu3",
        "7.80.0-3",
        "7.81.0-1",
        "7.81.0-1ubuntu1.1",
        "7.81.0-1ubuntu1.2",
        "7.81.0-1ubuntu1.3",
        "7.81.0-1ubuntu1.4",
        "7.81.0-1ubuntu1.6",
        "7.81.0-1ubuntu1.7",
        "7.81.0-1ubuntu1.8",
        "7.81.0-1ubuntu1.10",
        "7.81.0-1ubuntu1.11",
        "7.81.0-1ubuntu1.13",
        "7.81.0-1ubuntu1.14",
        "7.81.0-1ubuntu1.15",
        "7.81.0-1ubuntu1.16",
        "7.81.0-1ubuntu1.17",
        "7.81.0-1ubuntu1.18",
        "7.81.0-1ubuntu1.19",
        "7.81.0-1ubuntu1.20",
        "7.81.0-1ubuntu1.21",
        "7.81.0-1ubuntu1.22",
        "7.81.0-1ubuntu1.23",
        "7.81.0-1ubuntu1.24",
        "7.81.0-1ubuntu1.25",
        "7.81.0-1ubuntu1.26",
        "7.81.0-1ubuntu1.27",
        "7.81.0-1ubuntu1.29"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-94266",
      "fixed_version": "7.81.0-1ubuntu1.30",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-94266",
      "provider_updated_at": "2026-10-28T20:17:49.030056500Z",
      "applicability_unknown": true
    },
    {
      "name": "curl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.0-2ubuntu10.16"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "8.2.1-1ubuntu3",
        "8.2.1-1ubuntu3.1",
        "8.4.0-2ubuntu1",
        "8.5.0-2ubuntu1",
        "8.5.0-2ubuntu2",
        "8.5.0-2ubuntu8",
        "8.5.0-2ubuntu9",
        "8.5.0-2ubuntu10",
        "8.5.0-2ubuntu10.1",
        "8.5.0-2ubuntu10.2",
        "8.5.0-2ubuntu10.3",
        "8.5.0-2ubuntu10.4",
        "8.5.0-2ubuntu10.5",
        "8.5.0-2ubuntu10.6",
        "8.5.0-2ubuntu10.7",
        "8.5.0-2ubuntu10.8",
        "8.5.0-2ubuntu10.9",
        "8.5.0-2ubuntu10.10",
        "8.5.0-2ubuntu10.11",
        "8.5.0-2ubuntu10.12",
        "8.5.0-2ubuntu10.13",
        "8.5.0-2ubuntu10.15"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-94266",
      "fixed_version": "8.5.0-2ubuntu10.16",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-94266",
      "provider_updated_at": "2026-10-28T20:17:49.030056500Z",
      "applicability_unknown": true
    },
    {
      "name": "curl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.20.0-2ubuntu11.1"
            }
          ]
        }
      ],
      "release": "26.10",
      "versions": [
        "8.18.0-1ubuntu2",
        "8.20.0-2ubuntu1",
        "8.20.0-2ubuntu3",
        "8.20.0-2ubuntu10",
        "8.20.0-2ubuntu11"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-94266",
      "fixed_version": "8.20.0-2ubuntu11.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-94266",
      "provider_updated_at": "2026-10-28T20:17:49.030056500Z",
      "applicability_unknown": true
    },
    {
      "name": "curl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.18.0-1ubuntu2.8"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "8.14.1-2ubuntu1",
        "8.17.0-1ubuntu1",
        "8.18.0-1ubuntu1",
        "8.18.0-1ubuntu2",
        "8.18.0-1ubuntu2.1",
        "8.18.0-1ubuntu2.2",
        "8.18.0-1ubuntu2.3",
        "8.18.0-1ubuntu2.4",
        "8.18.0-1ubuntu2.5",
        "8.18.0-1ubuntu2.7"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-94266",
      "fixed_version": "8.18.0-1ubuntu2.8",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-94266",
      "provider_updated_at": "2026-10-28T20:17:49.030056500Z",
      "applicability_unknown": true
    },
    {
      "name": "curl",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.23.0-r0"
            }
          ]
        }
      ],
      "release": "3.23",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2026-94266",
      "fixed_version": "8.23.0-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2026-94266",
      "provider_updated_at": "2026-10-25T16:30:02.582640333Z",
      "applicability_unknown": true
    },
    {
      "name": "curl",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.23.0-r0"
            }
          ]
        }
      ],
      "release": "3.24",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2026-94266",
      "fixed_version": "8.23.0-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2026-94266",
      "provider_updated_at": "2026-10-25T16:30:02.582640333Z",
      "applicability_unknown": true
    }
  ]
}

Publisher notes

[trixie] curl: Minor issue

OpenFactory catalog packages

[Alpine Linux 3.21]

[curl]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r2 · aarch64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r2 · x86_64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-dbg]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r2 · aarch64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r2 · x86_64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-dev]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r2 · aarch64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r2 · x86_64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-doc]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r2 · aarch64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r2 · x86_64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-fish-completion]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r2 · aarch64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r2 · x86_64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-static]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r2 · aarch64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r2 · x86_64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-zsh-completion]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r2 · aarch64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r2 · x86_64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[libcurl]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r2 · aarch64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r2 · x86_64 · v3.21
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24

[Alpine Linux 3.22]

[curl]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r3 · aarch64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r3 · x86_64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-dbg]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r3 · aarch64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r3 · x86_64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-dev]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r3 · aarch64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r3 · x86_64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-doc]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r3 · aarch64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r3 · x86_64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-fish-completion]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r3 · aarch64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r3 · x86_64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-static]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r3 · aarch64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r3 · x86_64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-zsh-completion]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r3 · aarch64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r3 · x86_64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[libcurl]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.14.1-r3 · aarch64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.14.1-r3 · x86_64 · v3.22
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24

[Alpine Linux 3.23]

[curl]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.20.0-r0 · aarch64 · v3.23
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.20.0-r0 · x86_64 · v3.23
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-dbg]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.20.0-r0 · aarch64 · v3.23
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.20.0-r0 · x86_64 · v3.23
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-dev]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.20.0-r0 · aarch64 · v3.23
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.20.0-r0 · x86_64 · v3.23
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
[curl-doc]Unbekannt
Quellpaket: [curl]
Details (2)
- 8.20.0-r0 · aarch64 · v3.23
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24
- 8.20.0-r0 · x86_64 · v3.23
  Unbekannt · Behoben: 8.23.0-r0
  Version impact unknown
  pypi · curl · alpine · 3.23; pypi · curl · alpine · 3.24

Weitere Ergebnisse

Beobachtet: Oct 29, 2026, 8:35:17 AM UTC

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]