CVE-2026-13608

HighCVSS 7.4/10Last modified Sep 15, 2026

Description

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-923

Affected software

Vendor	Product	Versions
curl	curl	>= 7.82.0, < 8.14.2; >= 8.15.0, < 8.16.1; >= 8.17.0, < 8.20.1; >= 8.21.0, < 8.22.0
curl	curl	>= eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4, < ea71c3b6b60e563651ea8596a975aef0c8199519
curl	curl	8.21.0; 8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1

References

https://curl.se/docs/CVE-2026-13608.htmlPatch, Vendor Advisory
https://curl.se/docs/CVE-2026-13608.jsonVendor Advisory
https://hackerone.com/reports/3822248Exploit, Third Party Advisory
https://hackerone.com/reports/3822248Exploit, Third Party Advisory

Timeline

Published: Sep 6, 2026
Last modified: Sep 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-136098.8The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, w CVE-2026-13619.8ASDA-Soft Stack-based Buffer Overflow Vulnerability CVE-2026-136107.5The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowi CVE-2026-136115.3The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated att CVE-2026-136124.3The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated CVE-2026-136138.8The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query,CVE-2026-136228.8A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix socke CVE-2026-136234.8An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation M CVE-2026-13639.8IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers CVE-2026-136355.3An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-7280 CVE-2026-136399.8An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009 CVE-2026-13649.8IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate syste