curl: HSTS multi-trailing-dot bypass-ish: possible incomplete fix for CVE-2022-30115

🗓️ 13 May 2026 22:12:17Reported by giant_anteaterType

hackerone

hackerone🔗 hackerone.com👁 12 Views

CVE-2022-30115: HSTS fix incomplete for multiple trailing dots; use while loops in hsts.c.

Reporter	Title	Published	Views	Family All 74
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	23 Sep 202222:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in libcURL affect IBM Rational ClearCase ( CVE-2022-27778, CVE-2022-27779, CVE-2022-27780, CVE-2022-27782, CVE-2022-30115, CVE-2022-27774 )	25 Jul 202214:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent and Base Module use libcurl with multiple known vulnerabilities	6 Oct 202204:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is vulnerable to issues with libcurl (CVE-2022-27780, CVE-2022-30115)	25 Aug 202215:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7	24 Oct 202411:46	–	ibm
FreeBSD	curl -- Multiple vulnerabilities	11 May 202200:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 10 package curl version 7.83.1-alt1	19 May 202200:00	–	altlinux
ATTACKERKB	CVE-2022-30115	2 Jun 202214:15	–	attackerkb
Tenable Nessus	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-065)	6 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-206)	4 Nov 202200:00	–	nessus

18 May 2026 13:24Current

6.8Medium risk

Vulners AI Score6.8

CVSS 24

CVSS 3.14.3

EPSS0.00083

strict transport security trailing dot issue hostname normalization hsts code fix hsts file load