CVE-2026-18924 – curl

This curl update fixes five vulnerabilities in libcurl that affect memory safety, connection reuse, and TLS trust enforcement. CVE-2026-19931 has a CVSS score of 9.8, Critical severity: libcurl can wrongly reuse a Negotiate-authenticated connection, so one user's request can travel over another user's authenticated session. CVE-2026-18924 has a CVSS score of 9.1, Critical severity: a use-after-free in HTTP/2 Server Push cleanup on shared connections can enable remote code execution and privilege escalation. CVE-2026-80229 has a CVSS score of 7.5, High severity: pooled TLS connections in OpenSSL 3 provider configurations keep a dangling pointer after the easy handle is destroyed, causing a heap use-after-free that can lead to code execution.

CVE-2026-80230 has a CVSS score of 7.5, High severity: libcurl skips public key pinning when peer verification is disabled, letting unauthenticated connections succeed. CVE-2026-82208 has a CVSS score of 7.5, High severity: with the wolfSSL backend, a cached trust store can silently replace a callback-selected one and accept certificates that should be rejected. Proof-of-concept code exists for CVE-2026-18924, CVE-2026-19931, CVE-2026-80230, and CVE-2026-82208. Apply this update promptly to every system and application that bundles libcurl.