{"kind": "product", "path": "vulns/alpine-v3.21/curl", "name": "curl", "product": "curl", "ecosystem": "Alpine:v3.21", "items": [{"id": "ALPINE-CVE-2026-92392", "noindex": false, "published": "2026-10-14T08:17:05.997Z", "modified": "2026-10-25T16:30:02.649366960Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-92392", "title": "ALPINE-CVE-2026-92392", "description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-92392", "https://osv.dev/vulnerability/ALPINE-CVE-2026-92392"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-8927", "noindex": false, "published": "2026-07-03T07:16:25.123Z", "modified": "2026-10-18T12:30:02.950648492Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-8927", "title": "ALPINE-CVE-2026-8927", "description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-8927", "https://osv.dev/vulnerability/ALPINE-CVE-2026-8927"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-8924", "noindex": false, "published": "2026-07-03T07:16:24.793Z", "modified": "2026-10-18T12:30:04.070729842Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-8924", "title": "ALPINE-CVE-2026-8924", "description": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-8924", "https://osv.dev/vulnerability/ALPINE-CVE-2026-8924"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-8286", "noindex": false, "published": "2026-07-03T07:16:24.453Z", "modified": "2026-10-18T12:30:02.973517968Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-8286", "title": "ALPINE-CVE-2026-8286", "description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-8286", "https://osv.dev/vulnerability/ALPINE-CVE-2026-8286"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-7168", "noindex": false, "published": "2026-05-13T13:01:57.200Z", "modified": "2026-10-18T12:30:02.982249696Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-7168", "title": "ALPINE-CVE-2026-7168", "description": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-7168", "https://osv.dev/vulnerability/ALPINE-CVE-2026-7168"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-6429", "noindex": false, "published": "2026-05-13T13:01:56.930Z", "modified": "2026-10-18T12:30:04.035818245Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-6429", "title": "ALPINE-CVE-2026-6429", "description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-6429", "https://osv.dev/vulnerability/ALPINE-CVE-2026-6429"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-6276", "noindex": false, "published": "2026-05-13T13:01:56.800Z", "modified": "2026-10-18T12:30:04.074752146Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-6276", "title": "ALPINE-CVE-2026-6276", "description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-6276", "https://osv.dev/vulnerability/ALPINE-CVE-2026-6276"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-6253", "noindex": false, "published": "2026-05-13T13:01:56.570Z", "modified": "2026-10-18T12:30:02.955717770Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-6253", "title": "ALPINE-CVE-2026-6253", "description": "curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-6253", "https://osv.dev/vulnerability/ALPINE-CVE-2026-6253"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-5773", "noindex": false, "published": "2026-05-13T13:01:56.307Z", "modified": "2026-10-18T12:30:02.955213455Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-5773", "title": "ALPINE-CVE-2026-5773", "description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happ", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-5773", "https://osv.dev/vulnerability/ALPINE-CVE-2026-5773"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-5545", "noindex": false, "published": "2026-05-13T13:01:56.190Z", "modified": "2026-10-18T12:30:04.112589967Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-5545", "title": "ALPINE-CVE-2026-5545", "description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:passwo", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-5545", "https://osv.dev/vulnerability/ALPINE-CVE-2026-5545"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-4873", "noindex": false, "published": "2026-05-13T13:01:55.893Z", "modified": "2026-10-18T12:30:02.989728992Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-4873", "title": "ALPINE-CVE-2026-4873", "description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-4873", "https://osv.dev/vulnerability/ALPINE-CVE-2026-4873"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-3805", "noindex": false, "published": "2026-03-11T11:16:00.967Z", "modified": "2026-10-18T12:30:04.086093527Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-3805", "title": "ALPINE-CVE-2026-3805", "description": "When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-3805", "https://osv.dev/vulnerability/ALPINE-CVE-2026-3805"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-3784", "noindex": false, "published": "2026-03-11T11:16:00.437Z", "modified": "2026-10-18T12:30:02.988987448Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-3784", "title": "ALPINE-CVE-2026-3784", "description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-3784", "https://osv.dev/vulnerability/ALPINE-CVE-2026-3784"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-3783", "noindex": false, "published": "2026-03-11T11:16:00.080Z", "modified": "2026-10-18T12:30:04.040673612Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-3783", "title": "ALPINE-CVE-2026-3783", "description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-3783", "https://osv.dev/vulnerability/ALPINE-CVE-2026-3783"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2025-14819", "noindex": false, "published": "2026-01-08T10:15:46.730Z", "modified": "2026-10-18T12:30:02.984475183Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2025-14819", "title": "ALPINE-CVE-2025-14819", "description": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user's wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-14819", "https://osv.dev/vulnerability/ALPINE-CVE-2025-14819"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2025-14524", "noindex": false, "published": "2026-01-08T10:15:46.607Z", "modified": "2026-10-18T12:30:02.981006309Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2025-14524", "title": "ALPINE-CVE-2025-14524", "description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-14524", "https://osv.dev/vulnerability/ALPINE-CVE-2025-14524"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2025-13034", "noindex": false, "published": "2026-01-08T10:15:45.407Z", "modified": "2026-10-18T12:30:03.012665675Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2025-13034", "title": "ALPINE-CVE-2025-13034", "description": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification.", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-13034", "https://osv.dev/vulnerability/ALPINE-CVE-2025-13034"], "fixes": ["8.14.1-r3"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2025-9086", "noindex": false, "published": "2025-09-12T06:15:44.100Z", "modified": "2026-09-15T08:30:51.080123104Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2025-9086", "title": "ALPINE-CVE-2025-9086", "description": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depend", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-9086", "https://osv.dev/vulnerability/ALPINE-CVE-2025-9086"], "fixes": ["8.14.1-r2"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2025-10148", "noindex": false, "published": "2025-09-12T06:15:40.020Z", "modified": "2026-09-16T08:30:04.545997549Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2025-10148", "title": "ALPINE-CVE-2025-10148", "description": "curl's WebSocket code did not update the 32-bit mask pattern for each new\noutgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-10148", "https://osv.dev/vulnerability/ALPINE-CVE-2025-10148"], "fixes": ["8.14.1-r2"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2025-5399", "noindex": false, "published": "2025-06-07T08:15:20.687Z", "modified": "2026-08-27T22:18:02.990922023Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2025-5399", "title": "ALPINE-CVE-2025-5399", "description": "Due to a mistake in libcurl's WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-5399", "https://osv.dev/vulnerability/ALPINE-CVE-2025-5399"], "fixes": ["8.14.1-r0"], "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}]}], "total": 138, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 7, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "curl", "path": "vulns/alpine-v3.21/curl", "ecosystem": "Alpine:v3.21"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-25T16:30:02.649366960Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}