A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3953 advisory.

    When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect     occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which     erroneously bypasses the initialization of critical SSH security options like     CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime     successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified.
    Because the tool layer skipped the security configuration, these SSH host verification options are     silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.
    (CVE-2026-12064)

    A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to     be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle     (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.
    (CVE-2026-13608)

    When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification     (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning     on connections established without a presented server certificate. Bypassing the pinning check under these     disabled-verification conditions allows unauthenticated connections to succeed when they should be     rejected. (CVE-2026-80230)

    A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an     existing live connection even though the TLS configuration mismatches so it should not. (CVE-2026-8286)

    A flaw in curl's cookie parsing logic allows a malicious HTTP server to set super cookies that bypass     the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl     subsequently scopes and transmits to unrelated third-party domains. (CVE-2026-8924)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8820-1 advisory.

    Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain     circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation.
    This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13608)

    Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server Push streams when sharing     connections between handles. A remote attacker could possibly use this issue to cause curl to crash,     resulting in a denial of service, or execute arbitrary code. (CVE-2026-18924)

    Stanislav Fort discovered that curl incorrectly managed the lifetime of pooled TLS connections when using     the multi interface. An attacker could possibly use this issue to cause curl to crash, resulting in a     denial of service, or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80229)

    Stanislav Fort discovered that curl did not properly enforce public key pinning when certificate     verification was disabled in certain circumstances. A remote attacker could possibly use this issue to     bypass pinning checks and cause curl to accept connections that should have been rejected.
    (CVE-2026-80230)

    Stanislav Fort discovered that curl incorrectly handled the Secure attribute of cookies in certain     circumstances. A remote attacker could possibly use this issue to obtain sensitive information. This issue     only affected Ubuntu 26.04 LTS. (CVE-2026-80255)

    Stanislav Fort discovered that curl did not properly enforce Public Suffix List boundaries when handling     cookies in certain circumstances. A remote attacker could possibly use this issue to cause cookies to be     sent to unrelated domains, resulting in sensitive information being exposed. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-82209)

    Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a     handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to     obtain sensitive credentials. This issue was previously fixed in USN-8487-1, but that fix was incomplete     for Ubuntu 16.04 LTS. (CVE-2026-8927)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4048-1 advisory.

    - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
    - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4047-1 advisory.

    - CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
    - CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
    - CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
    - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
    - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

    Changes for curl:

    - Call http_size() first to prioritize Transfer-Encoding: chunked over a zero      Content-Length empty body check (bsc#1264971)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4071-1 advisory.

    - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
    - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21774-1 advisory.

    - CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
    - CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
    - CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
    - CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
    - CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
    - CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to     be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle     (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.
    (CVE-2026-13608)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
351113	Amazon Linux 2 : curl (ALAS-2026-3953)	Nessus	Amazon Linux Local Security Checks	Local	critical
350699	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : curl vulnerabilities (USN-8820-1)	Nessus	Ubuntu Local Security Checks	Local	critical
348465	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:4048-1)	Nessus	SuSE Local Security Checks	Local	high
348459	SUSE SLES15 Security Update : curl (SUSE-SU-2026:4047-1)	Nessus	SuSE Local Security Checks	Local	high
348430	SUSE SLES12 Security Update : curl (SUSE-SU-2026:4071-1)	Nessus	SuSE Local Security Checks	Local	high
343957	openSUSE 16: curl / curl-fish-completion / curl-zsh-completion / libcurl-devel / etc (openSUSE-SU-2026:21774-1)	Nessus	SuSE Local Security Checks	Local	high
342422	Linux Distros Unpatched Vulnerability : CVE-2026-13608	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-13608

high

Tenable Plugins

critical

critical

high

high

high

high

high