curl: TLS session resumption client cert bypass with CURLOPT_SSL_CTX_FUNCTION

AI use Cipher, by Causal Security, was used to find, exploit and confirm this issue. A further check was carried out to establish, as far as is possible from outside the project, that it is neither a duplicate of an existing report or advisory nor documented as intended behaviour. Everything belo...

Ruby on Rails: Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown

Summary ActionText::Contenttomarkdown escapes text nodes so that a stored rich text body cannot turn into Markdown syntax. Text whose immediate parent is or is exempt from that escaping MarkdownConversion::SKIPESCAPINGPARENTS and is instead kept inert by the delimiter its visitor wraps around it...

curl: HTTP Digest nonce reused across an https→http scheme change on the same handle

Hi all, Last one from my side. Looks like https://hackerone.com/reports/3793260 was not patched completely correctly, and libcurl emit a live Authorization: Digest response computed from a nonce/realm it only ever received over TLS preemptively over plaintext HTTP, on a reused easy handle that...

curl: Apple SecTrust fallback ignores CURLOPT_CRLFILE, letting a revoked cert pass

When libcurl is built with USEAPPLESECTRUST and the native Apple trust store is in use, a certificate that OpenSSL/GnuTLS rejects because it is on the operator's CURLOPTCRLFILE list is re-checked by Apple's SecTrust API instead, and SecTrust is never told about that CRL file at all. The bug...

curl: IMAP connection reuse runs requests in the wrong case-sensitive mailbox

When libcurl reuses an authenticated IMAP connection, lib/imap.c:2071-2089 uses curlstrequal to decide whether the requested mailbox is already selected. RFC 9051 section 5.1 requires clients to work with servers where non-INBOX mailbox names are case-sensitive, while only INBOX is guaranteed to ...

curl: 56: IBM i CL wrapper `parse_command_line()` never enters quote mode

Summary In projects/OS400/curlcl.c, the parsecommandline function initializes quote to '\0' but no code path ever assigns an opening ' or " to it. The close-quote check line 82, quote-aware backslash handling line 88, and unterminated-quote error line 106 are all dead code. As a result, quote...

curl: 55: Heap-buffer-overflow read in `curl_formadd_ccsid()` with binary form data

Summary curlformaddccsid in projects/OS400/ccsidcurl.c performs a heap-buffer-overflow read when CURLFORMCONTENTTYPE appears before an explicit length CURLFORMCONTENTLEN / CURLFORMCONTENTSLENGTH for binary CURLFORMCOPYCONTENTS data containing embedded NUL bytes. The overread bytes are copied into...

curl: 53: HTTP/1 CONNECT chunked-407 trailers bypass CURLOPT_SUPPRESS_CONNECT_HEADERS and lose CURLH_CONNECT classification

Summary When an HTTP/1 proxy returns a chunked 407 Proxy Authentication Required during a CONNECT handshake, any trailer fields in that response are delivered to the header callback even when CURLOPTSUPPRESSCONNECTHEADERS is enabled, and are classified as CURLHTRAILER instead of CURLHCONNECT in t...

curl: 50: CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usable

Summary The CMake HTTPONLY=ON option is documented as "Disable all protocols except HTTP" CMakeLists.txt:538, but the implementation CMakeLists.txt:541-557 only sets CURLDISABLE flags for non-SSH protocols. It does not disable CURLUSELIBSSH2 or CURLUSELIBSSH. Since CURLUSELIBSSH2 defaults to ON, ...

curl: 57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()`

Summary curleasyescapeccsid and curleasyunescapeccsid in projects/OS400/ccsidcurl.c discard the converted byte count returned by dynconvert and pass 0 to the downstream curleasyescape / curleasyunescape. When the caller supplies a positive explicit length with non-NUL-terminated input, dynconvert...

curl: 54: Rejected HTTP/2 push destroys MIME callback state still used by parent (use-after-free)

Summary pushpromise in lib/http2.c duplicates the parent easy handle before validating the pushed URL. When validation fails e.g. unsupported scheme, discardnewhandle destroys the duplicate. For callback-backed MIME uploads, Curlmimeduppart copies the same readfunc, freefunc, and arg pointer, so...

curl: 49: Cookie-jar save transfers group access to a different GID

Summary Curlfopen copies the old cookie jar's permission bits onto a newly created temp file, but the temp file may receive a different GID the process's primary group instead of the old file's group. After rename, group-permission bits that were intended for one group now authorize a different...

curl: 42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions

Summary VMSSTS in src/toolvms.h line 46 uses a comparison 3 where a left-shift 3 is intended. This causes VMSSTSHIDE to evaluate to 0x10000001 instead of 0x10000000, setting bit 0 the OpenVMS success bit. When curl runs under DCL with --silent and without --show-error, the mask is ORed into the...

curl: 41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

Summary When curl is launched with stdin fd 0 and stderr fd 2 closed, maincheckfds in src/toolmain.c can assign opposite ends of the same pipe to fd 0 and fd 2. In verbose mode with a stdin-based upload through an authenticated proxy, the Proxy-Authorization header written to stderr becomes...

curl: 37: `curl_mprintf` `%F` format specifier not consumed, causing variadic argument desynchronization

Summary docs/libcurl/curlmprintf.md documents %F as a conversion that consumes a double, alongside %f. However, parseconversion in lib/mprintf.c has no F case — it falls through to the default branch and returns without assigning an input slot. In a sequential format like "%F%s", the %s conversio...

curl: 22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal

Summary When CURLOPTWILDCARDMATCH is enabled, libcurl concatenates the server-provided LIST filename directly onto the wildcard path and then URL-decodes the combined string. A filename containing percent-encoded path separators e.g. %2e%2e%2fsecret.txt is decoded into ../secret.txt, causing...

curl: 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface

Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface Summary When a proxy is configured with a literal link-local IPv6 address and an explicit zone ID e.g. http://fe80::1%25eth0:8080, curl parses and stores the zone correctly but never applies it to the socket...

curl: 11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes first

Summary When HTTP/2 transfers share a multiplexed connection, CURLOPTFORBIDREUSE set by a transfer that completes before the other active streams is silently discarded. The connection survives into the idle pool and can be reused by a subsequent transfer. This breaks the mitigation documented in...

curl: 08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust path

Summary The fix for CVE-2026-7009 commit 51905671e0 does not cover AWS-LC. In osslappleverify in lib/vtls/openssl.c, a missing OCSP staple is detected only when SSLgettlsextstatusocspresp returns a negative length. OpenSSL returns -1 for absence, but AWS-LC returns 0 with a NULL output pointer. O...

curl: 07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verification

GnuTLS 0-RTT early data bypasses file-backed public-key pin verification Summary When CURLSSLOPTEARLYDATA is enabled and CURLOPTPINNEDPUBLICKEY references a file path, replacing that file's contents between connections does not invalidate the TLS session cache. On the next connection, curl sends...