curl: 42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions

Summary VMSSTS in src/toolvms.h line 46 uses a comparison 3 where a left-shift 3 is intended. This causes VMSSTSHIDE to evaluate to 0x10000001 instead of 0x10000000, setting bit 0 the OpenVMS success bit. When curl runs under DCL with --silent and without --show-error, the mask is ORed into the...

curl: 41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

Summary When curl is launched with stdin fd 0 and stderr fd 2 closed, maincheckfds in src/toolmain.c can assign opposite ends of the same pipe to fd 0 and fd 2. In verbose mode with a stdin-based upload through an authenticated proxy, the Proxy-Authorization header written to stderr becomes...

curl: 37: `curl_mprintf` `%F` format specifier not consumed, causing variadic argument desynchronization

Summary docs/libcurl/curlmprintf.md documents %F as a conversion that consumes a double, alongside %f. However, parseconversion in lib/mprintf.c has no F case — it falls through to the default branch and returns without assigning an input slot. In a sequential format like "%F%s", the %s conversio...

curl: 22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal

Summary When CURLOPTWILDCARDMATCH is enabled, libcurl concatenates the server-provided LIST filename directly onto the wildcard path and then URL-decodes the combined string. A filename containing percent-encoded path separators e.g. %2e%2e%2fsecret.txt is decoded into ../secret.txt, causing...

curl: 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface

Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface Summary When a proxy is configured with a literal link-local IPv6 address and an explicit zone ID e.g. http://fe80::1%25eth0:8080, curl parses and stores the zone correctly but never applies it to the socket...

curl: 11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes first

Summary When HTTP/2 transfers share a multiplexed connection, CURLOPTFORBIDREUSE set by a transfer that completes before the other active streams is silently discarded. The connection survives into the idle pool and can be reused by a subsequent transfer. This breaks the mitigation documented in...

curl: 08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust path

Summary The fix for CVE-2026-7009 commit 51905671e0 does not cover AWS-LC. In osslappleverify in lib/vtls/openssl.c, a missing OCSP staple is detected only when SSLgettlsextstatusocspresp returns a negative length. OpenSSL returns -1 for absence, but AWS-LC returns 0 with a NULL output pointer. O...

curl: 07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verification

GnuTLS 0-RTT early data bypasses file-backed public-key pin verification Summary When CURLSSLOPTEARLYDATA is enabled and CURLOPTPINNEDPUBLICKEY references a file path, replacing that file's contents between connections does not invalidate the TLS session cache. On the next connection, curl sends...

curl: 06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

Summary Curlvtlsappleverify in lib/vtls/apple.c passes the stapled OCSP response to SecTrustSetOCSPResponse only when both HAVEBUILTINAVAILABLE and SUPPORTSSecOCSP are defined. When HAVEBUILTINAVAILABLE is absent, the OCSP buffer is silently discarded. GCC does not support builtinavailable, so th...

curl: CVE-2026-82208: wolfSSL CA-cache hit overrides callback

Summary With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, curl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then...

curl: CVE-2026-80255: secure cookie attribute bypass with tab

Summary A Set-Cookie header using HTAB horizontal tab instead of SPACE before the Secure attribute — e.g. Set-Cookie: sid=SECRET;\tSecure — causes curl to store the cookie without its Secure flag. The cookie is then sent over plaintext HTTP on subsequent requests to the same host. The...

curl: CVE-2026-82209: domain-scoped PSL domain cookie

Summary When libpsl is enabled and a response host is itself a public suffix e.g. github.io, a Set-Cookie header whose Domain attribute exactly equals that host is accepted by psliscookiedomainacceptable but stored with tailmatch = TRUE. RFC 6265 §5.3 requires this exact-match case to produce a...

curl: 12: SASL DIGEST-MD5 does not validate the server's `rspauth` proof

Summary curl never verifies the rspauth value the server sends during SASL DIGEST-MD5 authentication. In Curlsaslcontinue lib/curlsasl.c, the SASLDIGESTMD5RESP handler unconditionally sends an empty acknowledgment without reading or checking the server's continuation data. Authentication then...

curl: 10: CURLOPT_MAXLIFETIME_CONN bypass on active HTTP/2 connections

Summary CURLOPTMAXLIFETIMECONN is not enforced when a new transfer is attached to an active multiplexed HTTP/2 connection. The connection-age eligibility check in urlmatchconn is gated behind !CONNINUSEconn, so an in-use HTTP/2 connection with spare stream capacity is accepted without any age...

curl: 46: `--libcurl` output carries `--insecure` across `--next` boundaries

Summary When --libcurl generates C source for a command that uses --next to separate multiple operations, local options from earlier operations leak into later ones. Specifically, if the first operation uses --insecure and the second does not, the generated program silently skips TLS certificate...

curl: 43: HTTP proxy CONNECT header chooses the `-OJ` filename after a redirect

Summary When curl follows an HTTPS redirect through an HTTP CONNECT proxy, a stale response code lets the proxy's CONNECT response Content-Disposition header control the local output filename. With --location --remote-name --remote-header-name, the proxy-provided filename is used for the...

curl: 34: `curl_mprintf` reads `double` for documented `long double` conversions — uninitialized value disclosure

Summary docs/libcurl/curlmprintf.md documents that the L length modifier makes floating-point conversions %f, %e, %E, %g, %G accept a long double argument. The implementation in lib/mprintf.c recognizes L and sets FLAGSLONGDOUBLE, but the conversion switch %f/%e/%E/%g/%G unconditionally selects...

curl: 36: HTTP upload resume offset consumed twice after early 307/308 redirect

Summary A read-backed HTTP POST using CURLOPTRESUMEFROMLARGE with a non-seekable source silently uploads the wrong data when the server returns a 307 or 308 redirect before the request body is sent. curleasyperform returns CURLEOK, so the caller cannot detect the substitution. The bug is in...

curl: 33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

Summary After a completed CURLOPTCONNECTONLY transfer, detaching the shared connection pool via curleasysetopteasy, CURLOPTSHARE, NULL causes curleasysend / curleasyrecv to silently operate on an unrelated connection from a different pool. Data intended for server B is sent to server A, and A's...

curl: 27: IMAP custom FETCH listing classification skips literal boundaries, enabling response desynchronization

Summary iscustomfetchlistingmatch in lib/imap.c classifies any custom FETCH whose sequence set contains : or , as a "listing." For that classification, imapstatelistsearchresp skips literal detection entirely. The ping-pong line parser then scans the server-declared literal body as IMAP protocol...