CVE-2026-11856 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
curl	CNA	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 50.95%

Affected Products (NVD)

Vendor	Product	Version
haxx	curl	7.10.6 ≤ 𝑥 < 8.21.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
curl	curl	7.10.6 ≤ 𝑥 < 8.14.2	CNA
curl	curl	8.15.0 ≤ 𝑥 < 8.16.1	CNA
curl	curl	8.17.0 ≤ 𝑥 < 8.20.1	CNA
curl	curl	8.20.0	CNA
curl	curl	8.19.0	CNA
curl	curl	8.18.0	CNA
curl	curl	8.17.0	CNA
curl	curl	8.16.0	CNA
curl	curl	8.15.0	CNA
curl	curl	8.14.1	CNA
curl	curl	8.14.0	CNA
curl	curl	8.13.0	CNA
curl	curl	8.12.1	CNA
curl	curl	8.12.0	CNA
curl	curl	8.11.1	CNA
curl	curl	8.11.0	CNA
curl	curl	8.10.1	CNA
curl	curl	8.10.0	CNA
curl	curl	8.9.1	CNA
curl	curl	8.9.0	CNA
curl	curl	8.8.0	CNA
curl	curl	8.7.1	CNA
curl	curl	8.7.0	CNA
curl	curl	8.6.0	CNA
curl	curl	8.5.0	CNA
curl	curl	8.4.0	CNA
curl	curl	8.3.0	CNA
curl	curl	8.2.1	CNA
curl	curl	8.2.0	CNA
curl	curl	8.1.2	CNA
curl	curl	8.1.1	CNA
curl	curl	8.1.0	CNA
curl	curl	8.0.1	CNA
curl	curl	8.0.0	CNA
curl	curl	7.88.1	CNA
curl	curl	7.88.0	CNA
curl	curl	7.87.0	CNA
curl	curl	7.86.0	CNA
curl	curl	7.85.0	CNA
curl	curl	7.84.0	CNA
curl	curl	7.83.1	CNA
curl	curl	7.83.0	CNA
curl	curl	7.82.0	CNA
curl	curl	7.81.0	CNA
curl	curl	7.80.0	CNA
curl	curl	7.79.1	CNA
curl	curl	7.79.0	CNA
curl	curl	7.78.0	CNA
curl	curl	7.77.0	CNA
curl	curl	7.76.1	CNA
curl	curl	7.76.0	CNA
curl	curl	7.75.0	CNA
curl	curl	7.74.0	CNA
curl	curl	7.73.0	CNA
curl	curl	7.72.0	CNA
curl	curl	7.71.1	CNA
curl	curl	7.71.0	CNA
curl	curl	7.70.0	CNA
curl	curl	7.69.1	CNA
curl	curl	7.69.0	CNA
curl	curl	7.68.0	CNA
curl	curl	7.67.0	CNA
curl	curl	7.66.0	CNA
curl	curl	7.65.3	CNA
curl	curl	7.65.2	CNA
curl	curl	7.65.1	CNA
curl	curl	7.65.0	CNA
curl	curl	7.64.1	CNA
curl	curl	7.64.0	CNA
curl	curl	7.63.0	CNA
curl	curl	7.62.0	CNA
curl	curl	7.61.1	CNA
curl	curl	7.61.0	CNA
curl	curl	7.60.0	CNA
curl	curl	7.59.0	CNA
curl	curl	7.58.0	CNA
curl	curl	7.57.0	CNA
curl	curl	7.56.1	CNA
curl	curl	7.56.0	CNA
curl	curl	7.55.1	CNA
curl	curl	7.55.0	CNA
curl	curl	7.54.1	CNA
curl	curl	7.54.0	CNA
curl	curl	7.53.1	CNA
curl	curl	7.53.0	CNA
curl	curl	7.52.1	CNA
curl	curl	7.52.0	CNA
curl	curl	7.51.0	CNA
curl	curl	7.50.3	CNA
curl	curl	7.50.2	CNA
curl	curl	7.50.1	CNA
curl	curl	7.50.0	CNA
curl	curl	7.49.1	CNA
curl	curl	7.49.0	CNA
curl	curl	7.48.0	CNA
curl	curl	7.47.1	CNA
curl	curl	7.47.0	CNA
curl	curl	7.46.0	CNA
curl	curl	7.45.0	CNA
curl	curl	7.44.0	CNA
curl	curl	7.43.0	CNA
curl	curl	7.42.1	CNA
curl	curl	7.42.0	CNA
curl	curl	7.41.0	CNA
curl	curl	7.40.0	CNA
curl	curl	7.39.0	CNA
curl	curl	7.38.0	CNA
curl	curl	7.37.1	CNA
curl	curl	7.37.0	CNA
curl	curl	7.36.0	CNA
curl	curl	7.35.0	CNA
curl	curl	7.34.0	CNA
curl	curl	7.33.0	CNA
curl	curl	7.32.0	CNA
curl	curl	7.31.0	CNA
curl	curl	7.30.0	CNA
curl	curl	7.29.0	CNA
curl	curl	7.28.1	CNA
curl	curl	7.28.0	CNA
curl	curl	7.27.0	CNA
curl	curl	7.26.0	CNA
curl	curl	7.25.0	CNA
curl	curl	7.24.0	CNA
curl	curl	7.23.1	CNA
curl	curl	7.23.0	CNA
curl	curl	7.22.0	CNA
curl	curl	7.21.7	CNA
curl	curl	7.21.6	CNA
curl	curl	7.21.5	CNA
curl	curl	7.21.4	CNA
curl	curl	7.21.3	CNA
curl	curl	7.21.2	CNA
curl	curl	7.21.1	CNA
curl	curl	7.21.0	CNA
curl	curl	7.20.1	CNA
curl	curl	7.20.0	CNA
curl	curl	7.19.7	CNA
curl	curl	7.19.6	CNA
curl	curl	7.19.5	CNA
curl	curl	7.19.4	CNA
curl	curl	7.19.3	CNA
curl	curl	7.19.2	CNA
curl	curl	7.19.1	CNA
curl	curl	7.19.0	CNA
curl	curl	7.18.2	CNA
curl	curl	7.18.1	CNA
curl	curl	7.18.0	CNA
curl	curl	7.17.1	CNA
curl	curl	7.17.0	CNA
curl	curl	7.16.4	CNA
curl	curl	7.16.3	CNA
curl	curl	7.16.2	CNA
curl	curl	7.16.1	CNA
curl	curl	7.16.0	CNA
curl	curl	7.15.5	CNA
curl	curl	7.15.4	CNA
curl	curl	7.15.3	CNA
curl	curl	7.15.2	CNA
curl	curl	7.15.1	CNA
curl	curl	7.15.0	CNA
curl	curl	7.14.1	CNA
curl	curl	7.14.0	CNA
curl	curl	7.13.2	CNA
curl	curl	7.13.1	CNA
curl	curl	7.13.0	CNA
curl	curl	7.12.3	CNA
curl	curl	7.12.2	CNA
curl	curl	7.12.1	CNA
curl	curl	7.12.0	CNA
curl	curl	7.11.2	CNA
curl	curl	7.11.1	CNA
curl	curl	7.11.0	CNA
curl	curl	7.10.8	CNA
curl	curl	7.10.7	CNA
curl	curl	7.10.6	CNA

Debian Releases

Debian Product

Codename

curl

bookworm	postponed
bookworm (security)	vulnerable
bullseye	postponed
forky	8.22.0-1 fixed
sid	8.23.0~rc2-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

curl

bionic	Fixed 7.58.0-2ubuntu3.24+esm11 released
focal	Fixed 7.68.0-1ubuntu2.25+esm6 released
jammy	Fixed 7.81.0-1ubuntu1.26 released
noble	Fixed 8.5.0-2ubuntu10.12 released
questing	ignored
resolute	Fixed 8.18.0-1ubuntu2.4 released
trusty	Fixed 7.35.0-1ubuntu2.20+esm22 released
xenial	Fixed 7.47.0-1ubuntu2.19+esm18 released

Amazon Linux Releases

Amazon Package

Release

curl

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

curl-debuginfo

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

curl-debugsource

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

curl-minimal

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

curl-minimal-debuginfo

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

libcurl

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

libcurl-debuginfo

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

libcurl-devel

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

libcurl-minimal

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

libcurl-minimal-debuginfo

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

Azure Linux Releases

Azure Package

Release

cmake

Azure Linux 3.0

0:3.30.3-15.azl3

fixed

curl

Azure Linux 3.0

0:8.11.1-11.azl3

fixed

Known Exploits!

Common Weakness Enumeration

CWE-294 - Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References

https://curl.se/docs/CVE-2026-11856.html

https://curl.se/docs/CVE-2026-11856.json

https://hackerone.com/reports/3793260