Skip to content

Product

azure linux cmake vulnerabilities

51 published CVES affecting azure linux cmake, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
51
Critical
7
High
10
Medium
30
Low
4
Unscored
0
CISA KEV
0

Latest azure linux cmake CVEs

Newest publication first · page 1 of 3

  2. CVE-2026-107928 info leak uploading over WebSockets with GnuTLS

    Published
    HighCVSS 8.1 EPSS 0.71%

    When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutls_record_send() returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does...

  3. CVE-2026-87866 wolfSSL public-key pinning bypass

    Published
    CriticalCVSS 9.1 EPSS 0.51%

    When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity l...

  4. CVE-2026-82209 domain-scoped PSL domain cookie

    Published
    HighCVSS 8.2 EPSS 0.37%

    When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk). Instead of coercing it...

  5. CVE-2026-80231 native CA store conn reuse

    Published
    HighCVSS 7.5 EPSS 0.90%

    A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.

  8. CVE-2026-9079 stale proxy password leak

    Published
    CriticalCVSS 9.8 EPSS 1.1%

    libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

  9. CVE-2026-8932 incomplete mTLS config matching in conn reuse

    Published
    HighCVSS 7.5 EPSS 0.40%

    libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. How...

  10. CVE-2026-8927 env-set cross-proxy Digest auth state leak

    Published
    CriticalCVSS 9.1 EPSS 0.50%

    When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent tr...

  11. CVE-2026-8924 trailing dot domain super cookie

    Published
    CriticalCVSS 9.1 EPSS 0.66%

    A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

  12. CVE-2026-8458 wrong reuse for different services

    Published
    MediumCVSS 6.5 EPSS 0.37%

    libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid ov...

  13. CVE-2026-8286 wrong STARTTLS connection reuse

    Published
    HighCVSS 8.1 EPSS 0.31%

    A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

  14. CVE-2026-11856 cross-origin Digest auth state leak

    Published
    CriticalCVSS 9.8 EPSS 0.69%

    Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for...

  15. CVE-2026-10536 HTTP/2 stream-dependency tree UAF

    Published
    CriticalCVSS 9.8 EPSS 0.60%

    A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this...

  16. CVE-2026-56412 libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a u...

    Published
    MediumCVSS 5.9 EPSS 0.19%

    libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix fo...

  25. CVE-2026-6276 stale custom cookie host causes cookie leak

    Published
    HighCVSS 7.5 EPSS 0.30%

    Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom Host: header set, the second request would use stale information and pass on cookies meant for the first host in...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.