curl: IDN decoding inserts authority delimiters and can redirect proxy CONNECT to a different host

🗓️ 20 Oct 2026 18:52:26Reported by zefanxuType

hackerone🔗 hackerone.com👁 4 Views

libcurl IDN decoder accepts FULLWIDTH COMMERCIAL AT, leading to authority delimiter issues.

Reporter	Title	Published	Views	Family All 226
FreeBSD	curl -- multiple vulnerabilities	26 Oct 202200:00	–	freebsd
FreeBSD	cURL -- multiple vulnerabilities	2 Nov 201600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL component shipped with IBM Rational ClearCase (CVE-2016-8624, CVE-2016-8625)	10 Jul 201808:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libcURL affect IBM Rational ClearCase ( CVE-2022-42915, CVE-2022-42916, CVE-2022-32221, CVE-2022-35252, CVE-2022-32205, CVE-2022-32206, CVE-2022-32207 )	31 Jan 202314:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	14 Mar 202316:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libcurl and cURL affect Rational DOORS	1 May 202007:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect agent is vulnerable to using components with know vulnerabilities	5 Dec 202219:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7	24 Oct 202411:46	–	ibm
IBM Security Bulletins	Security Bulletin: The Community Edition of IBM ILOG CPLEX Optimization Studio is affected by multiple vulnerabilities in libcurl (CVE-2022-42915, CVE-2022-42916, CVE-2022-32221)	17 Nov 202208:48	–	ibm
ALT Linux	Security fix for the ALT Linux 8 package curl version 7.51.0-alt1	2 Nov 201600:00	–	altlinux

21 Oct 2026 21:34Current

7High risk

Vulners AI Score7

CVSS 25

CVSS 35.3 - 7.5

CVSS 3.17.5

EPSS0.04321

SSVC

libcurl IDN decoder authority delimiter libidn2 proxy CONNECT CURLE_OUT_OF_MEMORY