kapsl Index
Docs Releases

curl

1 tool · 1 release line

Transfer data with URLs (HTTP, HTTPS, FTP, and more). Every tool here carries the same sandbox boundary.

kapsl curl
Source ↗ Registry ↗

Release lines we maintain · the project decides these

findings shown are the whole project at that line

Tag Resolves to Lifecycle Updated Findings What the tag promises
  • stable — floats, carries security updates
  • unstable — tracks pre-releases, may break
  • eol — frozen, upstream is done

Tools in this project · pick one to inspect

all share one boundary

Tool Capabilities Seccomp Findings Image Description
showing curl from curl@latest → 8.18.0 stable

Findings

C3H10M2

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-19931 ↗ C 9.8 curl A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials.
CVE-2026-18924 ↗ C 9.1 curl A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
CVE-2026-66032 ↗ H 8.7 libssh2 libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session.
CVE-2026-66033 ↗ H 8.7 libssh2 libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by…
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-82209 ↗ H 8.2 curl When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g.…
CVE-2026-66035 ↗ H 7.7 libssh2 libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length…
CVE-2026-80229 ↗ H 7.5 curl When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles.
CVE-2026-80230 ↗ H 7.5 curl When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established…
CVE-2026-80255 ↗ H 7.5 curl A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag.
CVE-2026-8932 ↗ H 7.5 curl libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
CVE-2026-13608 ↗ H 7.4 curl A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification.
CVE-2026-13757 ↗ M 6.2 p11-kit A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing…
CVE-2026-18938 ↗ M 6.2 p11-kit A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability.

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex

These are the findings of curl, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Composition

default nothing — stands alone
runtime none — self-contained
composes not used as a runtime

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Image

name curl
platforms
size 19 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Sandbox boundary

curl

capabilities

netrw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

  • ~/.curlrc
  • ~/.config/curlrc

env passed through

9 forwarded

ALL_PROXYFTP_PROXYHTTPS_PROXYNO_PROXYall_proxyftp_proxyhttp_proxyhttps_proxyno_proxy

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

15 findings across this project at latest. Counted once per advisory across every image the project builds.