# Haxx Curl


- [CVE-2026-19931](https://insights.sbomify.com/CVE-2026-19931/): Negotiate ambient user conn reuse (critical 9.8)
- [CVE-2026-10536](https://insights.sbomify.com/CVE-2026-10536/): HTTP/2 stream-dependency tree UAF (critical 9.8)
- [CVE-2026-11856](https://insights.sbomify.com/CVE-2026-11856/): cross-origin Digest auth state leak (critical 9.8)
- [CVE-2026-8925](https://insights.sbomify.com/CVE-2026-8925/): SASL double-free (critical 9.8)
- [CVE-2026-9079](https://insights.sbomify.com/CVE-2026-9079/): stale proxy password leak (critical 9.8)
- [CVE-2023-27533](https://insights.sbomify.com/CVE-2023-27533/): Command injection in https://github.com/curl/curl (critical 9.8)
- [CVE-2022-32221](https://insights.sbomify.com/CVE-2022-32221/): Use after free in https://github.com/curl/curl (critical 9.8)
- [CVE-2022-32207](https://insights.sbomify.com/CVE-2022-32207/): Misconfiguration in https://github.com/curl/curl (critical 9.8)
- [CVE-2016-4606](https://insights.sbomify.com/CVE-2016-4606/): Code injection in curl (critical 9.8)
- [CVE-2019-5481](https://insights.sbomify.com/CVE-2019-5481/): Use after free in curl (critical 9.8)
- [CVE-2019-5482](https://insights.sbomify.com/CVE-2019-5482/): Memory corruption in curl (critical 9.8)
- [CVE-2018-0500](https://insights.sbomify.com/CVE-2018-0500/): Memory corruption in curl before 7.61.0 (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/haxx/curl/