USN-8927-1: curl vulnerabilities

It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928) Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPT_INTERFACE was used. An attacker could possibly use this issue to cause connections to go out from an unintended source address. (CVE-2026-107929) Stanislav Fort discovered that curl did not properly clear AWS SigV4…

Quelle: Originalartikel öffnen