curl: 29: CURLOPT_ISSUERCERT accepts a different-key certificate when issuer metadata collides

Summary osslcheckissuer in lib/vtls/openssl.c uses X509checkissued to implement CURLOPTISSUERCERT. This OpenSSL function checks metadata subject/issuer names, key identifiers, algorithm compatibility, key usage but does not verify the certificate's cryptographic signature. A certificate with...

curl: 28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket

Summary When CURLOPTSOCKOPTFUNCTION returns CURLSOCKOPTALREADYCONNECTED, the HTTP/3 QUIC UDP code path ignores it and calls connect anyway, silently reassociating the application-provided socket to a different peer. The TCP path has the correct check. This violates the documented callback contrac...

curl: Heap-use-after-free in CURLOPT_REFERER when passed a CURLINFO_REFERER pointer

Summary Setting CURLOPTREFERER with a pointer previously obtained from CURLINFOREFERER on the same easy handle triggers a heap-use-after-free. The CURLOPTREFERER handler frees data-state.referer line lib/setopt.c:2089 before Curlsetstropt reads from the now-dangling pointer line...

curl: Stacked --proto modifiers leave denied protocol enabled

Summary proto2num line 431–447 consumes only one leading modifier character via a switch statement. The documentation says entries may be "prefixed by zero or more modifiers." Before commit 86ac471d, a loop consumed all modifiers. The replacement switch reads only the first character. --proto...

curl: --etag-save - truncates append-redirected stdout

Summary saveetag line 267–273 calls fileno, fstat, ftruncatefd, 0 whenever the underlying fd is a regular file. It does not check OutStruct.regularfile, which is FALSE for stdout even when shell-redirected to a file. When --etag-save - is used with append redirection , an HTTP 2xx/3xx response...

curl: CVE-2026-80256: wcurl backslash bypass

A vulnerability was discovered in the wcurl script of the curl project. The vulnerability allowed an attacker-controlled URL to create a new file outside the directory chosen by a Windows user, subject to the user's filesystem permissions and the target not already existing. The vulnerability was...

curl: CVE-2026-80231: native CA store conn reuse

Summary nativecastore is in struct sslconfigdata line 73 of vtlsconfig.h, not sslprimaryconfig. matchsslprimaryconfig does not compare it. On macOS, Curlssleasyconfigcomplete line 258 auto-sets nativecastore = TRUE when no custom CA is configured — without modifying ssloptions. When CURLCABUNDLE ...

curl: CVE-2026-80230: OpenSSL pinning bypass

Summary Curlosslcheckpeercert line 4795 calls SSLget1peercertificate. When no peer certificate is available — as with anonymous cipher suites like AECDH-AES128-SHA — the function returns NULL. The subsequent guard at lines 4798–4799 checks !connconfig-verifypeer || connconfig-verifyhost; when bot...

curl: CVE-2026-80229: OpenSSL provider use-after-free

Summary When CURLOPTSSLENGINE is set e.g. "default" on OpenSSL 3.x, osslsetprovider line 1791 allocates a per-handle OSSLLIBCTX and stores it in data-state.libctx. During TLS connection setup, SSLCTXnewex line 3750 receives this library context and embeds a pointer to it inside the newly created...

curl: OpenSSL ENGINE selection omitted from mTLS connection matching

Summary When an application sets CURLOPTSSLENGINE to select an OpenSSL ENGINE for resolving ENG-type client certificate and private key identifiers, the engine selection is not included in the TLS configuration compared during connection reuse. A second easy handle with a different engine but the...

curl: Unbound cross-peer HTTP Digest challenge state

Summary When libcurl parses an HTTP Digest WWW-Authenticate challenge, it stores the realm, nonce, algorithm, and qop into the easy handle's state.digest — but does not bind that state to the peer that sent it. If the challenge is parsed but never used for output e.g. because Basic or Bearer was...

curl: ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

cleanarg operates on char str, which is the UTF-8 copy allocated by converttchartoUTF8. It has no reference to the original wchart argv element. c / toolgetparam.c:632 / static void cleanargchar str / now that getstr has copied the contents of nextarg, wipe the next argument out so that the...

curl: curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack

Summary: CURLSH the curl share handle allows multiple easy handles to share state — cookies, DNS cache, SSL sessions, connection cache — across threads. The share is protected by optional user-supplied mutex callbacks CURLSHOPTLOCKFUNC / CURLSHOPTUNLOCKFUNC. When a caller invokes curlsharesetopts...

curl: TLS session cache case-folds CA paths and bypasses the active trust profile

curl 8.21.0 case-folds the entire TLS session-cache peer key, so two distinct CA files whose Unix paths differ only by case can share a TLS session ticket. At lib/vtls/vtlsscache.c:723, curlstrequal compares keys that include case-sensitive CA, CRL, and issuer paths, even though...

curl: wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0

Summary When curl is built against wolfSSL, setting CURLOPTSSLVERIFYPEER=0 causes a hostname-mismatched certificate to be accepted even though CURLOPTSSLVERIFYHOST remains at its default enabled setting. I built wolfSSL from source, built curl against it, and connected to a TLS server presenting ...

curl: RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions

Summary libcurl's RTSP code interpolates the values of CURLOPTRTSPSTREAMURI, CURLOPTRTSPTRANSPORT, and CURLOPTRTSPSESSIONID directly into the RTSP request text with no check for embedded CR/LF, so a value containing \r\n splits one intended RTSP operation into multiple independent RTSP requests o...

curl: libcurl Digest/NTLM authentication ignores an explicit Authorization header

Summary When an application sets an explicit Authorization header via CURLOPTHTTPHEADER while libcurl also has credentials configured and HTTP Digest or NTLM authentication is selected/challenged, libcurl does not honor the application's header as a replacement — it sends its own internally...

curl: Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts

When curl loads a cookie file written as raw HTTP Set-Cookie: header lines and a line has no Domain attribute, the cookie is stored with co-domain == NULL, because a file import has no request-host to scope it to. On the send side, Curlcookiegetlist accepts any cookie in the bucket whose domain i...

curl: libcurl cache updates follow symlinks and truncate their targets

Summary: When curl updates an HSTS, Alt-Svc, or cookie cache, it opens the supplied path with "w" before validating it, so a symlink path can truncate the file it targets. Root cause: Curlfopen calls curlxfopenfilename, "w" before checking the path or creating the safe temporary file, and fopen...

curl: Windows SSPI connection-pool probe can reuse a connection under the wrong user

Summary : A fresh transfer can reuse a keep-alive connection authenticated under another Windows user because the SSPI isolation check trusts a connection ID that a health probe can set. Root cause : Curlcpoolconnseemshealthy calls Curlattachconnection, which sets data-state.recentconnid, while...