CVE-2026-13608

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

Scoring

Severity

HIGH

CVSS base score

7.4

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS probability

0.64%

CWE

CWE-923

Published

2026-09-06

Last modified

2026-09-16

Affected products

• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl

Weakness type

• CWE-923

Related vulnerabilities

• CVE-2019-17440 — PAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC) allows root access
• CVE-2026-34205 — Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode
• CVE-2017-3891 — In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default conf
• CVE-2023-28078 — Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured. A
• CVE-2025-61939 — Columbia Weather Systems MicroServer Improper Restriction of Communication Channel to Intended Endpoints
• CVE-2025-20261 — Cisco Integrated Management Controller Privilege Escalation Vulnerability
• CVE-2021-38487 — Potential Network Amplification and Information Exposure in RTI Connext Professional and Connext Micro
• CVE-2025-58742 — Insufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector Capture

Markdown version · Browse all CVEs