CVE-2026-13608: curl, заобикаляне на вход и права

Описание

Оригинално описание

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

Засегнати продукти

• curl curl: 7.82.0 преди 8.14.2; 8.15.0 преди 8.16.1; 8.17.0 преди 8.20.1; 8.21.0 преди 8.22.0
• curl curl: eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4 преди ea71c3b6b60e563651ea8596a975aef0c8199519
• curl curl: 8.21.0; 8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1; 8.7.0; 8.6.0; 8.5.0; 8.4.0; 8.3.0; 8.2.1; 8.2.0; 8.1.2; 8.1.1; 8.1.0; 8.0.1; 8.0.0; 7.88.1; 7.88.0; 7.87.0; 7.86.0; 7.85.0; 7.84.0; 7.83.1; 7.83.0; 7.82.0

Вид слабост

• CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

История

Други уязвимости в curl curl

• 8.1CVE-2026-107929
• 8.1CVE-2026-107928
• 7.5CVE-2026-94266
• 9.1CVE-2026-94265
• 7.5CVE-2026-92391

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-13608
• https://nvd.nist.gov/vuln/detail/CVE-2026-13608
• https://curl.se/docs/CVE-2026-13608.json
• https://curl.se/docs/CVE-2026-13608.html
• https://hackerone.com/reports/3822248