curl: HTTP/2 proxy CONNECT tunnel unbounded 1xx chain (missing Curl_bump_headersize cap in cf-h2-proxy.c)

🗓️ 13 May 2026 22:42:20Reported by giant_anteaterType

Malicious HTTPS on HTTP/2 proxy can cause unbounded curl memory growth during CONNECT by streaming 1xx responses, bypassing the cap.

Reporter	Title	Published	Views	Family All 140
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities	22 Nov 202315:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libcURL affect IBM Rational ClearCase.	13 Mar 202414:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to cURL libcurl. (CVE-2023-38039)	6 Dec 202313:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple publicly disclosed libcurl vulnerabilities affect IBM Safer Payments	4 Apr 202410:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use the MQ clients and CCDT files are vulnerable to denial of service due to [CVE-2023-38039]	14 Dec 202310:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affect IBM Robotic Process Automation for Cloud Pak.	22 Nov 202320:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is affected by a vulnerability in libcURL	31 Oct 202317:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	20 Dec 202319:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues	14 Mar 202414:34	–	ibm

19 May 2026 13:52Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.14797

SSVC