curl: 50: CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usable

Summary The CMake HTTPONLY=ON option is documented as "Disable all protocols except HTTP" CMakeLists.txt:538, but the implementation CMakeLists.txt:541-557 only sets CURLDISABLE flags for non-SSH protocols. It does not disable CURLUSELIBSSH2 or CURLUSELIBSSH. Since CURLUSELIBSSH2 defaults to ON, ...

curl: 42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions

Summary VMSSTS in src/toolvms.h line 46 uses a comparison 3 where a left-shift 3 is intended. This causes VMSSTSHIDE to evaluate to 0x10000001 instead of 0x10000000, setting bit 0 the OpenVMS success bit. When curl runs under DCL with --silent and without --show-error, the mask is ORed into the...

curl: 41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

Summary When curl is launched with stdin fd 0 and stderr fd 2 closed, maincheckfds in src/toolmain.c can assign opposite ends of the same pipe to fd 0 and fd 2. In verbose mode with a stdin-based upload through an authenticated proxy, the Proxy-Authorization header written to stderr becomes...

curl: 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface

Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface Summary When a proxy is configured with a literal link-local IPv6 address and an explicit zone ID e.g. http://fe80::1%25eth0:8080, curl parses and stores the zone correctly but never applies it to the socket...

curl: 06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

Summary Curlvtlsappleverify in lib/vtls/apple.c passes the stapled OCSP response to SecTrustSetOCSPResponse only when both HAVEBUILTINAVAILABLE and SUPPORTSSecOCSP are defined. When HAVEBUILTINAVAILABLE is absent, the OCSP buffer is silently discarded. GCC does not support builtinavailable, so th...

curl: 46: `--libcurl` output carries `--insecure` across `--next` boundaries

Summary When --libcurl generates C source for a command that uses --next to separate multiple operations, local options from earlier operations leak into later ones. Specifically, if the first operation uses --insecure and the second does not, the generated program silently skips TLS certificate...

curl: 34: `curl_mprintf` reads `double` for documented `long double` conversions — uninitialized value disclosure

Summary docs/libcurl/curlmprintf.md documents that the L length modifier makes floating-point conversions %f, %e, %E, %g, %G accept a long double argument. The implementation in lib/mprintf.c recognizes L and sets FLAGSLONGDOUBLE, but the conversion switch %f/%e/%E/%g/%G unconditionally selects...

curl: 33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

Summary After a completed CURLOPTCONNECTONLY transfer, detaching the shared connection pool via curleasysetopteasy, CURLOPTSHARE, NULL causes curleasysend / curleasyrecv to silently operate on an unrelated connection from a different pool. Data intended for server B is sent to server A, and A's...

curl: 28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket

Summary When CURLOPTSOCKOPTFUNCTION returns CURLSOCKOPTALREADYCONNECTED, the HTTP/3 QUIC UDP code path ignores it and calls connect anyway, silently reassociating the application-provided socket to a different peer. The TCP path has the correct check. This violates the documented callback contrac...

curl: Stacked --proto modifiers leave denied protocol enabled

Summary proto2num line 431–447 consumes only one leading modifier character via a switch statement. The documentation says entries may be "prefixed by zero or more modifiers." Before commit 86ac471d, a loop consumed all modifiers. The replacement switch reads only the first character. --proto...

curl: --etag-save - truncates append-redirected stdout

Summary saveetag line 267–273 calls fileno, fstat, ftruncatefd, 0 whenever the underlying fd is a regular file. It does not check OutStruct.regularfile, which is FALSE for stdout even when shell-redirected to a file. When --etag-save - is used with append redirection , an HTTP 2xx/3xx response...

curl: Unbound cross-peer HTTP Digest challenge state

Summary When libcurl parses an HTTP Digest WWW-Authenticate challenge, it stores the realm, nonce, algorithm, and qop into the easy handle's state.digest — but does not bind that state to the peer that sent it. If the challenge is parsed but never used for output e.g. because Basic or Bearer was...

curl: ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

cleanarg operates on char str, which is the UTF-8 copy allocated by converttchartoUTF8. It has no reference to the original wchart argv element. c / toolgetparam.c:632 / static void cleanargchar str / now that getstr has copied the contents of nextarg, wipe the next argument out so that the...

curl: curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack

Summary: CURLSH the curl share handle allows multiple easy handles to share state — cookies, DNS cache, SSL sessions, connection cache — across threads. The share is protected by optional user-supplied mutex callbacks CURLSHOPTLOCKFUNC / CURLSHOPTUNLOCKFUNC. When a caller invokes curlsharesetopts...

curl: TLS session cache case-folds CA paths and bypasses the active trust profile

curl 8.21.0 case-folds the entire TLS session-cache peer key, so two distinct CA files whose Unix paths differ only by case can share a TLS session ticket. At lib/vtls/vtlsscache.c:723, curlstrequal compares keys that include case-sensitive CA, CRL, and issuer paths, even though...

curl: wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0

Summary When curl is built against wolfSSL, setting CURLOPTSSLVERIFYPEER=0 causes a hostname-mismatched certificate to be accepted even though CURLOPTSSLVERIFYHOST remains at its default enabled setting. I built wolfSSL from source, built curl against it, and connected to a TLS server presenting ...

curl: RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions

Summary libcurl's RTSP code interpolates the values of CURLOPTRTSPSTREAMURI, CURLOPTRTSPTRANSPORT, and CURLOPTRTSPSESSIONID directly into the RTSP request text with no check for embedded CR/LF, so a value containing \r\n splits one intended RTSP operation into multiple independent RTSP requests o...

curl: libcurl Digest/NTLM authentication ignores an explicit Authorization header

Summary When an application sets an explicit Authorization header via CURLOPTHTTPHEADER while libcurl also has credentials configured and HTTP Digest or NTLM authentication is selected/challenged, libcurl does not honor the application's header as a replacement — it sends its own internally...

curl: Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts

When curl loads a cookie file written as raw HTTP Set-Cookie: header lines and a line has no Domain attribute, the cookie is stored with co-domain == NULL, because a file import has no request-host to scope it to. On the send side, Curlcookiegetlist accepts any cookie in the bucket whose domain i...

curl: libcurl cache updates follow symlinks and truncate their targets

Summary: When curl updates an HSTS, Alt-Svc, or cookie cache, it opens the supplied path with "w" before validating it, so a symlink path can truncate the file it targets. Root cause: Curlfopen calls curlxfopenfilename, "w" before checking the path or creating the safe temporary file, and fopen...