1312526 matches found
curl: urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the host
Summary: six or fewer sentences describing the issue in your own human voice and optionally a short proof-of-concept script An app can set a host from untrusted input from CURLUPARTHOST, as the docs allow, and rely on curl to reject bad hosts. curl accepts fe80::1%[email protected]/x as a valid...
curl: SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections
The core effect is a silent host-authentication bypass: a transfer whose configured SSH host-key policy would reject the server is served anyway, with exit code 0 and no warning, because it reuses a pooled connection established under a weaker or absent policy. curl may assess this lower because ...
curl: RTSP ANNOUNCE/SET_PARAMETER upload with --use-ascii / CURLOPT_TRANSFERTEXT sends more body bytes than the declared Content-Length (incomplete fix of e
Summary curl refuses RTSP uploads that combine a body with --crlf / CURLOPTCRLF, because the LF→CRLF conversion makes the number of bytes actually sent differ from the Content-Length curl declares to the server. That guard was added as a security fix: - RTSP: commit e84f95a "rtsp: refuse doing...
curl: WebSocket decoder use-after-free when curl_easy_pause() unpauses from a debug callback
Summary At lib/ws.c:503, wsdecpasspayload holds a pointer into the WebSocket receive queue while passing a frame to the application's write callback. If that callback returns CURLWRITEFUNCPAUSE, the PAUSE requested trace invokes the debug callback before the WebSocket pass consumes those bytes...
curl: SCP upload with --crlf sends more bytes than the size declared to the server (same class curl refused for IMAP CVE-2026-87864 and RTSP)
Summary curl recently started REFUSING uploads that combine a size-declaring protocol with CRLF conversion, because the LF-CRLF expansion makes the number of bytes actually sent differ from the size declared to the server: - IMAP APPEND — CVE-2026-87864, lib/imap.c:885-886: ifdata-set.crlf...
curl: libcurl shared-HSTS-cache race leads to use-after-free with attacker-controlled function-pointer call
Missing lock on the shared HSTS cache in lib/hsts.c CURLLOCKDATAHSTS allows a race that frees an stsentry still referenced by another thread — deterministic same-address reclaim proves the freed object is fully attacker-writable and its destructor pointer is called with an attacker-chosen argumen...
curl: CRLF injection in the HTTP request-line via `CURLOPT_REQUEST_TARGET` (`--request-target`)
Summary The CURLOPTREQUESTTARGET option string reaches the wire with no CR/LF neutralization, even though it is formatted directly into the HTTP request-line, which is terminated by CRLF. Curlsetstropt lib/setopt.c stores the option string after checking only the 8 MB length cap CURLMAXINPUTLENGT...
curl: curl RTSP connection reuse routes response headers to the RTP callback (rtsp_conn state machine not reset between sessions)
Summary libcurl's RTSP client keeps a per-connection RTP parsing state machine in struct rtspconn state, inheader, rtplen, buf. This state machine is initialised exactly once, when a brand-new connection is allocated, and is never reset thereafter. RTSP connections are pooled and reused across...
curl: CRLF injection in the RTSP request-line and Transport header via `CURLOPT_RTSP_STREAM_URI` and `CURLOPT_RTSP_TRANSPORT`
Summary Two RTSP option strings reach the wire with no CR/LF neutralization, even though each is formatted directly into an RTSP request-line or header field that is terminated by CRLF. Curlsetstropt lib/setopt.c stores each option string after checking only the 8 MB length cap CURLMAXINPUTLENGTH...
curl: curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status line
Summary In the HTTP/1.1 proxy-CONNECT response parser lib/cf-h1-proxy.c, singleheader, the per-line counter data-req.headerline a.k.a. k-headerline is never incremented — only the tunnel-local ts-headerlines is. Curlreqsoftreset resets k-headerline to 0 before the CONNECT exchange begins, and it...
curl: Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests
Summary: With an HTTP proxy configured, I found that curl sends IPv4 address-literal requests through it with NOPROXY=0.0.0.0/0, and IPv6 address-literal requests through it with NOPROXY=::/0. A zero-bit CIDR prefix should match every address in its family, so those requests should bypass the...
curl: libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request
AI WAS USED IN THE PROCESS OF IDENTIFYING THIS VULNERABILITY. The vulnerability was tested manually and the report was carefully read. Suggested severity Low Affected version curl 8.23.0, tag curl-8230, commit 3163ec065643ba20709f190111f42c3e1fe95273. Affected interface The issue is reachable...
curl: libcurl TLS shorter-retry mismatch discloses client heap memory during cancelled IMAPS upload
Proof of Concept High-level reproduction: 1. Check out curl 8.22.0 at commit 01346829096c61b372692f6dc43ffa778c6caccd. 2. Build libcurl with either: - rustls-ffi 0.15.4 / rustls 0.23.45; or - GnuTLS 3.8.13. 3. Run the supplied loopback IMAPS server and multi-interface client. 4. The client starts...
curl: TFTP accepts a first response from an IP other than the requested server
Summary: When curl sends a TFTP request to the IP in the URL, it accepts the first valid response from any source IP and pins that sender as the transfer peer. A host that can get UDP packets to the client's ephemeral port and win this first-response race can receive bytes from a TFTP upload or...
curl: CVE-2026-107929: local interface connection reuse mixup
Summary: When CURLOPTINTERFACE is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address...
curl: CVE-2026-107928: info leak uploading over WebSockets with GnuTLS
Summary: When curl is built with GnuTLS, a malicious WebSocket server can make curl -T wss://... send memory past curl's WebSocket send buffer. This is due to an out of bounds read in gtlssend, which doesn't handle if gnutlsrecordsend returns a number of bytes sent greater than the number of byte...
curl: HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)
Since 8.22.0 libcurl reuses an idle HTTP/1.1 connection that already has unread bytes waiting on it, as long as the pool health check ran less than a second ago, and those bytes are then returned as the response to the next request sent on that connection, so every later response on it is shifted...
curl: Cookie attribute truncation in curl drops Secure/HttpOnly protections
Description: If a Set-Cookie header contains an = immediately after a semicolon i.e., ;=, curl stops parsing the attributes and discards everything that follows. This silently drops protections like Secure and HttpOnly, causing curl to later send the cookie over unencrypted HTTP. Root Cause: In...
curl: Rustls backend discloses out-of-bounds heap data during legal IMAP upload cancellation
Affected: Rustls-backed libcurl, curl 8.8.0 through 8.22.0 and current 8.23 development Summary A malicious IMAP server can apply TLS socket backpressure during an APPEND upload. If the application then legally removes the active easy handle from its multi handle, curl's IMAP cleanup sends a...