CVE-2026-13608
ADVISORY - nistSummary
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.
EPSS Score: 0.00479 (0.395)
Common Weakness Enumeration (CWE)
ADVISORY - nist
Improper Restriction of Communication Channel to Intended Endpoints
Alpine
CREATED
UPDATED
ADVISORY IDCVE-2026-13608
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| alpine/curl | apk | alpine | 3.24 | <8.22.0-r0 | 8.22.0-r0 |
| alpine/curl | apk | alpine | 3.22 | <=7.83.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.83.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.84.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.85.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.86.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.87.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r3 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | edge | <8.22.0-r0 | 8.22.0-r0 |
| alpine/curl | apk | alpine | 3.23 | <8.22.0-r0 | 8.22.0-r0 |
Severity and metrics
No CVSS data available from this advisory.
NIST
CREATED
UPDATED
ADVISORY IDCVE-2026-13608
EXPLOITABILITY SCORE
2.2
EXPLOITS FOUND
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
7.4highDebian
CREATED
UPDATED
ADVISORY IDCVE-2026-13608
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-13608
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AmediumAmazon
CREATED
UPDATED
ADVISORY IDALAS2-2026-3953
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AhighChainguard
CREATED
UPDATED
ADVISORY ID
CGA-53j2-cwvw-q5wj
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Photon
CREATED
UPDATED
ADVISORY ID
CVE-2026-13608
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
7.4highminimos
CREATED
UPDATED
ADVISORY ID
MINI-87wp-w438-rp52
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
minimos
CREATED
UPDATED
ADVISORY ID
MINI-9p79-634m-v44m
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-