Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-11856: curl package may allow execution of malicious code
CVE-2026-11856 · published 2 months ago
Summary
The curl tool used in Alpine Linux, Debian and several other distributions has a flaw that could let an attacker cause the program to run unwanted code. This could affect any system that uses curl for downloading files or making web requests. Update curl to the latest version provided by your operating system’s package manager to fix the issue.
What to do
- Update alpine curl to version 8.14.1-r20077.
- Update debian curl to version 8.21.0~rc3-1.
- Update alpine rootio-curl to version 8.14.1-r20077.
- Update alpine curl to version 8.14.1-r20074.
- Update bellsoft curl to version 8.21.0-r0.
- Update alpine curl to version 8.14.1-r20071.
- Update alpine rootio-curl to version 8.14.1-r20071.
- Update alpine curl to version 8.14.1-r20073.
- Update alpine rootio-curl to version 8.14.1-r20073.
- Update alpine curl to version 8.19.0-r00075.
- Update alpine rootio-curl to version 8.19.0-r00075.
- Update alpine rootio-curl to version 8.14.1-r20074.
- Update alpine curl to version 8.19.0-r00076.
- Update alpine rootio-curl to version 8.19.0-r00076.
- Update debian curl to version 7.74.0-1.3+deb11u16.root.io.17.
- Update debian rootio-curl to version 7.74.0-1.3+deb11u16.root.io.17.
- Update debian rootio-curl to version 7.88.1-10+deb12u15.aikido.13.
- Update debian rootio-curl to version 8.14.1-2+deb13u4.aikido.14.
- Update debian curl to version 8.14.1-2+deb13u4.aikido.14.
- Update curl to version 8.14.1-r20079.
- Update rootio-curl to version 8.14.1-r20079.
- Update curl to version 8.14.1-2+deb13u5.aikido.18.
- Update rootio-curl to version 8.14.1-2+deb13u5.aikido.18.
- Update curl to version 8.14.1-2+deb13u5.aikido.19.
- Update rootio-curl to version 8.14.1-2+deb13u5.aikido.19.
- Update curl to version 8.22.0-r0.
- Update curl to version 8.21.0-r0.
- Update curl to version 8.14.1-r20074.
- Update rootio-curl to version 8.14.1-r20074.
- Update curl to version 8.14.1-r30076.
- Update rootio-curl to version 8.14.1-r30076.
- Update curl to version 8.14.1-r200710.
- Update rootio-curl to version 8.14.1-r200710.
- Update curl to version 8.14.1-r20073.
- Update rootio-curl to version 8.14.1-r20073.
- Update curl to version 7.88.1-10+deb12u15.aikido.16.
- Update rootio-curl to version 7.88.1-10+deb12u15.aikido.16.
- Update curl to version 8.14.1-r200711.
- Update rootio-curl to version 8.14.1-r200711.
- Update curl to version 8.14.1-r30077.
- Update rootio-curl to version 8.14.1-r30077.
- Update curl to version 8.5.0-r00073.
- Update rootio-curl to version 8.5.0-r00073.
- Update curl to version 8.14.1-r20075.
- Update rootio-curl to version 8.14.1-r20075.
- Update curl to version 8.14.1-2+deb13u5.aikido.20.
- Update rootio-curl to version 8.14.1-2+deb13u5.aikido.20.
- Update canonical curl to version 7.35.0-1ubuntu2.20+esm22.
- Update canonical curl to version 7.47.0-1ubuntu2.19+esm18.
- Update canonical curl to version 7.58.0-2ubuntu3.24+esm11.
- Update canonical curl to version 7.68.0-1ubuntu2.25+esm6.
- Update canonical curl to version 7.81.0-1ubuntu1.26.
- Update canonical curl to version 8.5.0-2ubuntu10.12.
- Update canonical curl to version 8.18.0-1ubuntu2.4.
- Update curl to version 8.14.1-r30079.
- Update rootio-curl to version 8.14.1-r30079.
- Update curl to version 8.14.1-r20076.
- Update rootio-curl to version 8.14.1-r20076.
- Update curl to version 8.5.0-r00074.
- Update rootio-curl to version 8.5.0-r00074.
- Update curl to version 8.14.1-r200712.
- Update rootio-curl to version 8.14.1-r200712.
- Update curl to version 8.14.1-2+deb13u5.aikido.21.
- Update rootio-curl to version 8.14.1-2+deb13u5.aikido.21.
- Update curl to version 8.14.1-2+deb13u5.aikido.22.
- Update rootio-curl to version 8.14.1-2+deb13u5.aikido.22.
- Update curl to version 7.88.1-10+deb12u15.aikido.17.
- Update rootio-curl to version 7.88.1-10+deb12u15.aikido.17.
- Update curl to version 8.14.1-r20077.
- Update rootio-curl to version 8.14.1-r20077.
- Update rootio-curl to version 8.5.0-2ubuntu10.11.aikido.1.
- Update curl to version 8.19.0-r00076.
- Update rootio-curl to version 8.19.0-r00076.
- Update haxx curl to version 8.21.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Root:Alpine:3.20 | alpine | curl |
< 8.14.1-r20077 Fix: upgrade to 8.14.1-r20077
|
| Debian:14 | debian | curl |
< 8.21.0~rc3-1 Fix: upgrade to 8.21.0~rc3-1
|
| Root:Alpine:3.20 | alpine | rootio-curl |
< 8.14.1-r20077 Fix: upgrade to 8.14.1-r20077
|
| Root:Alpine:3.22 | alpine | curl |
< 8.14.1-r20074 < 8.14.1-r20071 < 8.14.1-r20073 Fix: upgrade to 8.14.1-r20074
|
| – | curl | curl |
<= 8.20.0 < 8.14.2 < 5c6b4880357ab3e72967c1c45cae0f96ffabc535 8.20.0 |
| Alpaquita:stream | bellsoft | curl |
>= 8.1.2-r0, < 8.21.0-r0 Fix: upgrade to 8.21.0-r0
|
| Debian:11 | debian | curl | All versions |
| Debian:12 | debian | curl | All versions |
| Debian:13 | debian | curl | All versions |
| Root:Alpine:3.22 | alpine | rootio-curl |
< 8.14.1-r20071 < 8.14.1-r20073 < 8.14.1-r20074 Fix: upgrade to 8.14.1-r20071
|
| Root:Alpine:3.23 | alpine | curl |
< 8.19.0-r00075 < 8.19.0-r00076 Fix: upgrade to 8.19.0-r00075
|
| Root:Alpine:3.23 | alpine | rootio-curl |
< 8.19.0-r00075 < 8.19.0-r00076 Fix: upgrade to 8.19.0-r00075
|
| Ubuntu:Pro:14.04:LTS | canonical | curl |
< 7.35.0-1ubuntu2.20+esm22 Fix: upgrade to 7.35.0-1ubuntu2.20+esm22
|
| Ubuntu:Pro:16.04:LTS | canonical | curl |
< 7.47.0-1ubuntu2.19+esm18 Fix: upgrade to 7.47.0-1ubuntu2.19+esm18
|
| Ubuntu:Pro:18.04:LTS | canonical | curl |
< 7.58.0-2ubuntu3.24+esm11 Fix: upgrade to 7.58.0-2ubuntu3.24+esm11
|
| Ubuntu:Pro:20.04:LTS | canonical | curl |
< 7.68.0-1ubuntu2.25+esm6 Fix: upgrade to 7.68.0-1ubuntu2.25+esm6
|
| Ubuntu:22.04:LTS | canonical | curl |
< 7.81.0-1ubuntu1.26 Fix: upgrade to 7.81.0-1ubuntu1.26
|
| Ubuntu:24.04:LTS | canonical | curl |
< 8.5.0-2ubuntu10.12 Fix: upgrade to 8.5.0-2ubuntu10.12
|
| Ubuntu:25.10 | canonical | curl | All versions |
| Ubuntu:26.04:LTS | canonical | curl |
< 8.18.0-1ubuntu2.4 Fix: upgrade to 8.18.0-1ubuntu2.4
|
| BellSoft Hardened Containers:stream | bellsoft | curl |
>= 8.1.2-r0, < 8.21.0-r0 Fix: upgrade to 8.21.0-r0
|
| Root:Alpine:3.21 | alpine | curl |
< 8.14.1-r20073 Fix: upgrade to 8.14.1-r20073
|
| Root:Alpine:3.21 | alpine | rootio-curl |
< 8.14.1-r20073 Fix: upgrade to 8.14.1-r20073
|
| Root:Debian:11 | debian | curl |
< 7.74.0-1.3+deb11u16.root.io.17 Fix: upgrade to 7.74.0-1.3+deb11u16.root.io.17
|
| Root:Debian:11 | debian | rootio-curl |
< 7.74.0-1.3+deb11u16.root.io.17 Fix: upgrade to 7.74.0-1.3+deb11u16.root.io.17
|
| Root:Debian:12 | debian | rootio-curl |
< 7.88.1-10+deb12u15.aikido.13 Fix: upgrade to 7.88.1-10+deb12u15.aikido.13
|
| Root:Debian:13 | debian | rootio-curl |
< 8.14.1-2+deb13u4.aikido.14 Fix: upgrade to 8.14.1-2+deb13u4.aikido.14
|
| Root:Debian:13 | debian | curl |
< 8.14.1-2+deb13u4.aikido.14 Fix: upgrade to 8.14.1-2+deb13u4.aikido.14
|
| Root:Alpine:3.20 | – | curl |
< 8.14.1-r20079 < 8.14.1-r200710 < 8.14.1-r200711 < 8.14.1-r200712 Fix: upgrade to 8.14.1-r20079
|
| Root:Alpine:3.20 | – | rootio-curl |
< 8.14.1-r20079 < 8.14.1-r200710 < 8.14.1-r200711 < 8.14.1-r200712 Fix: upgrade to 8.14.1-r20079
|
| Root:Debian:13 | – | curl |
< 8.14.1-2+deb13u5.aikido.18 < 8.14.1-2+deb13u5.aikido.19 < 8.14.1-2+deb13u5.aikido.20 < 8.14.1-2+deb13u5.aikido.21 < 8.14.1-2+deb13u5.aikido.22 Fix: upgrade to 8.14.1-2+deb13u5.aikido.18
|
| Root:Debian:13 | – | rootio-curl |
< 8.14.1-2+deb13u5.aikido.18 < 8.14.1-2+deb13u5.aikido.19 < 8.14.1-2+deb13u5.aikido.20 < 8.14.1-2+deb13u5.aikido.21 < 8.14.1-2+deb13u5.aikido.22 Fix: upgrade to 8.14.1-2+deb13u5.aikido.18
|
| – | haxx | curl |
>= 7.10.6, < 8.21.0 cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Alpine:v3.23 | – | curl |
>= 7.10.6, < 8.22.0-r0 Fix: upgrade to 8.22.0-r0
|
| Alpine:v3.24 | – | curl |
>= 7.10.6, < 8.21.0-r0 Fix: upgrade to 8.21.0-r0
|
| Root:Alpine:3.22 | – | curl |
< 8.14.1-r20074 < 8.14.1-r30076 < 8.14.1-r30077 < 8.14.1-r30079 Fix: upgrade to 8.14.1-r20074
|
| Root:Alpine:3.22 | – | rootio-curl |
< 8.14.1-r20074 < 8.14.1-r30076 < 8.14.1-r30077 < 8.14.1-r30079 Fix: upgrade to 8.14.1-r20074
|
| Root:Alpine:3.21 | – | curl |
< 8.14.1-r20073 < 8.14.1-r20075 < 8.14.1-r20076 < 8.14.1-r20077 Fix: upgrade to 8.14.1-r20073
|
| Root:Alpine:3.21 | – | rootio-curl |
< 8.14.1-r20073 < 8.14.1-r20075 < 8.14.1-r20076 < 8.14.1-r20077 Fix: upgrade to 8.14.1-r20073
|
| Root:Debian:12 | – | curl |
< 7.88.1-10+deb12u15.aikido.16 < 7.88.1-10+deb12u15.aikido.17 Fix: upgrade to 7.88.1-10+deb12u15.aikido.16
|
| Root:Debian:12 | – | rootio-curl |
< 7.88.1-10+deb12u15.aikido.16 < 7.88.1-10+deb12u15.aikido.17 Fix: upgrade to 7.88.1-10+deb12u15.aikido.16
|
| Root:Alpine:3.15 | – | curl |
< 8.5.0-r00073 < 8.5.0-r00074 Fix: upgrade to 8.5.0-r00073
|
| Root:Alpine:3.15 | – | rootio-curl |
< 8.5.0-r00073 < 8.5.0-r00074 Fix: upgrade to 8.5.0-r00073
|
| Root:Ubuntu:24.04 | – | rootio-curl |
< 8.5.0-2ubuntu10.11.aikido.1 Fix: upgrade to 8.5.0-2ubuntu10.11.aikido.1
|
| Root:Alpine:3.23 | – | curl |
< 8.19.0-r00076 Fix: upgrade to 8.19.0-r00076
|
| Root:Alpine:3.23 | – | rootio-curl |
< 8.19.0-r00076 Fix: upgrade to 8.19.0-r00076
|
Original advisory text
CVE-2026-11856 in rootio-curl - Patched by Root
Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.
References
- https://docs.bell-sw.com/security/cves/CVE-2026-11856 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-11856 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-11856 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-11856 Third Party Advisory
- https://curl.se/L7HzKXisfJ/CVE-2026-11856.md Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11856... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-11856 Vendor Advisory
- https://github.com/curl/curl.git Product
- https://security.alpinelinux.org/vuln/CVE-2026-11856 Vendor Advisory
- https://curl.se/docs/CVE-2026-11856.html Patch Vendor Advisory
- https://curl.se/docs/CVE-2026-11856.json Vendor Advisory
- https://hackerone.com/reports/3793260 Exploit Issue Tracking Third Party Advisory
- https://ubuntu.com/security/notices/USN-8651-1 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-294Authentication Bypass by Capture-replay
Timeline
Published11 Aug 2026
Updated11 Oct 2026
First seen24 Jun 2026
Sources
UBUNTU-CVE-2026-11856 · OSV
CURL-CVE-2026-11856 · OSV
CVE-2026-11856 · NVD
CVE-2026-11856 · MITRE
BELL-CVE-2026-11856 · OSV
DEBIAN-CVE-2026-11856 · OSV
CVE-2026-11856 · OSV
ALPINE-CVE-2026-11856 · OSV
Track software like this
Free during beta