libcurl
Safeguard articles tagged "libcurl" — guides, analysis, and best practices for software supply chain and application security.
4 articles
curl 8.23.0 Fixes 24 CVEs: The One to Prioritise and How to Find Every libcurl You Ship
curl 8.23.0, released on 14 October 2026, fixes 24 CVEs in one go. That's more than curl published in all of 2024 and 2025 combined, and it takes the project's 2026 total to 69.
curl SOCKS5 Heap Overflow (CVE-2023-38545) Explained: When a Long Hostname Broke the Handshake
CVE-2023-38545 is a heap buffer overflow in curl and libcurl's SOCKS5 proxy handshake, triggered when a too-long hostname is copied into a fixed buffer during a slow handshake. Here is the bug.
Inside CVE-2023-38545: the libcurl SOCKS5 heap overflow
A single off-by-length check in curl's SOCKS5 handshake, live for over three years across libcurl 7.69.0–8.3.x, earned a 9.8 CVSS score and a CWE-787 out-of-bounds write.
CVE-2025-9086 in cURL: Patch Posture & SBOM Response
Heap out-of-bounds read in libcurl's cookie path comparison affects nearly every Linux distro. Defender SBOM playbook below.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.