Skip to content

Product

azure linux rust vulnerabilities

107 published CVES affecting azure linux rust, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
107
Critical
15
High
44
Medium
40
Low
8
Unscored
0
CISA KEV
0

Latest azure linux rust CVEs

Newest publication first · page 1 of 5

  3. CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF

    Published
    MediumCVSS 6.5

    zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the...

  10. CVE-2026-107929 local interface connection reuse mixup

    Published
    HighCVSS 8.1

    When CURLOPT_INTERFACE (or the command line tool's --interface option) is set with one of the documented prefixes (if!, host!, ifhost!), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connecti...

  11. CVE-2026-107928 info leak uploading over WebSockets with GnuTLS

    Published
    HighCVSS 8.1

    When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutls_record_send() returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does...

  12. CVE-2026-94265 Authorization: Negotiate sent to foreign origin

    Published
    CriticalCVSS 9.1

    When processing an HTTP redirect to a URL containing userinfo (a username:password component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary useri...

  13. CVE-2026-87866 wolfSSL public-key pinning bypass

    Published
    CriticalCVSS 9.1

    When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity l...

  14. CVE-2026-87861 cross-origin reuse of a Negotiate connection

    Published
    CriticalCVSS 9.1

    When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.

  15. CVE-2026-86415 auto client cert connection reuse mixup

    Published
    HighCVSS 7.5 EPSS 0.42%

    libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto c...

  16. CVE-2026-86413 Negotiate credentials sent to redirected origin

    Published
    CriticalCVSS 9.1 EPSS 0.73%

    When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.

  17. CVE-2026-86412 server-set cookie erases cookie jar

    Published
    HighCVSS 8.1 EPSS 0.83%

    A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, d...

  18. CVE-2026-86411 FTP connection reuse inherits client-certificate

    Published
    CriticalCVSS 9.1 EPSS 0.43%

    An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server...

  19. CVE-2026-92392 HTTP/2 upload Use-After-Free

    Published
    HighCVSS 8.1

    During an upload, curl mishandles HTTP/2 RST_STREAM received from the server (with reason HTTP_1_1_REQUIRED or REFUSED_STREAM) leading to a use after free of a struct Curl_easy object.

  25. CVE-2026-35191 QUIC Unvalidated Amplification Credit may be Over Accounted

    Published
    LowCVSS 3.7

    Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.