curl: CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entry

Summary In required netrc mode CURLNETRCREQUIRED, as set by --netrc or --netrc-file, the CURLOPTNETRC documentation says any credential information present in the URL is ignored, but when the configured .netrc file loads successfully yet has no entry matching the requested host and username,...

curl: --cert-status with OpenSSL accepts a stapled OCSP response of any age when it lacks nextUpdate (revoked certificate keeps passing)

Summary: curl built with OpenSSL accepts a stapled OCSP "good" response of any age under CURLOPTSSLVERIFYSTATUS --cert-status when the response omits nextUpdate, so a response signed before a certificate was revoked keeps passing the check for as long as the certificate itself is valid. The GnuTL...

curl: Heap-use-after-free in libcurl's multi event machinery (curl_multi_remove_handle() from a socket callback nested under a notify callback)

Summary: The multi interface in libcurl 8.23.0 and current master has a reproducible use-after-free. Inside a CURLMOPTNOTIFYFUNCTION callback, calling curleasypause on a second transfer that is still in flight re-enters libcurl's event handling and invokes the socket callback, where a...

curl: IDN decoding inserts authority delimiters and can redirect proxy CONNECT to a different host

IDN decoding can insert authority delimiters: CURLUPUNYCODE output does not round-trip and proxy requests carry an ambiguous authority Summary libcurl's IDN decoder accepts a hostname containing U+FF20 FULLWIDTH COMMERCIAL AT ＠. libidn2's TR46 transitional fallback converts it to ASCII @...

curl: POP3: data after the end-of-body terminator is written into the retrieved message

Vulnerability Information When a POP3 server sends the end-of-body terminator and further data in the same read, curl writes the bytes after the terminator into the retrieved message's output file and still reports success. The PoC returns the message, its "." line, and then a second "+OK" respon...

curl: A server response that answers nothing is used as the next transfer's reply — and with IMAP, a fully compliant server does this by accident

Name: Maturi Jaswanth Sai Madhu Mohan Product: curl / libcurl — all four pingpong protocols demonstrated: IMAP, POP3, SMTP and FTP — the same protocol set curl's own CVE-2026-92387 names Affected: reproduced on current git master dbb8262a9c 8.23.1-DEV, fetched and rebuilt today, on d1d4b5931a, on...

curl: HSTS cache file: three trailing dots silently disable HSTS for that host

Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/hsts.c Affected: curl 8.20.0, 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295 / CWE-693, an HSTS pin that silently stops applying Before we...

curl: TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another

Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/vtls/vtlsscache.c Affected: curl 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295, wrong client identity on a resumed TLS session. Same class ...

curl: curl reuses an HTTPS connection when a response is already buffered in the TLS stack

curl master 15292ed75, 8.23.1-DEV reuses an idle HTTP/1.1-over-TLS connection even when a complete extra response is already buffered in OpenSSL/GnuTLS. The ef6b17cf1 fix only polls the socket: Curlcpoolconnseemshealthy lib/conncache.c:1073, called from lib/url.c:1071 uses Curlconnisalive, and...

curl: Pinned public key check passes for a key the server does not hold with the wolfSSL backend

Summary: With the wolfSSL backend, --pinnedpubkey is checked against a public key that curl extracts by re-parsing the server certificate with its own ASN.1 parser lib/vtls/x509asn1.c, while wolfSSL verifies the chain with its own parser. curl 8.23.0 added a check that the validity field of the...

curl: urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the host

Summary: six or fewer sentences describing the issue in your own human voice and optionally a short proof-of-concept script An app can set a host from untrusted input from CURLUPARTHOST, as the docs allow, and rely on curl to reject bad hosts. curl accepts fe80::1%[email protected]/x as a valid...

curl: wolfSSL Backend Silently Ignores --cert-status (OCSP Stapling Bypass)

Summary When curl is built with the wolfSSL TLS backend, --cert-status CURLOPTSSLVERIFYSTATUS is silently accepted and ignored. The wolfSSL backend sets certstatusrequest = NULL in its vtable lib/vtls/wolfssl.c:2309, meaning OCSP stapling is not implemented. The curleasysetopt call returns...

curl: SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections

The core effect is a silent host-authentication bypass: a transfer whose configured SSH host-key policy would reject the server is served anyway, with exit code 0 and no warning, because it reuses a pooled connection established under a weaker or absent policy. curl may assess this lower because ...

curl: Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc caches

Affected Component - lib/curlfopen.c, Curlfopen, line 98: curlxfopenfilename, FOPENWRITETEXT - Callers: lib/cookie.c:1543 cookie jar save, lib/hsts.c:390 HSTS save, lib/altsvc.c:415 alt-svc save - CLI entry points: -c / --cookie-jar src/config2setopts.c:575, --hsts FILE :714, --alt-svc FILE :711...

curl: curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode)

Summary curl's non-blocking connection shutdown machinery lib/cshutdn.c is supposed to enforce a 2-second shutdown timeout DEFAULTSHUTDOWNTIMEOUTMS on connections whose peer never answers the graceful shutdown. In curlmultisocketaction event-driven mode the machinery deadlocks: the only code that...

curl: WebSocket send queue use-after-free during nested curl_ws_send()

At lib/ws.c:1734, wsflush borrows a pointer from the outgoing sendbuf and passes it to wssendrawblocking; it skips those bytes only after the send returns. A curlwssend from the WebSocket write callback can be interrupted by a TCP-trace debug callback that calls curlwssend again, and the nested...

curl: SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connection

Summary For SCP/SFTP, curl verifies the server's host key once, during the initial connect state machine, in sshcheckfingerprint — which reads CURLOPTSSHHOSTPUBLICKEYSHA256 / MD5, the CURLOPTSSHKNOWNHOSTS file, and the CURLOPTSSHHOSTKEYFUNCTION callback. That function has exactly one caller,...

curl: CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth

Summary When libcurl tunnels through an HTTP proxy with CONNECT HTTPS-over-proxy, the custom headers set via CURLOPTPROXYHEADER are sent to the proxy once, at tunnel-setup time lib/httpproxy.c:63-83. The connection-reuse decision for a proxied connection, however, does not take proxyheaders into...

curl: RTSP ANNOUNCE/SET_PARAMETER upload with --use-ascii / CURLOPT_TRANSFERTEXT sends more body bytes than the declared Content-Length (incomplete fix of e

Summary curl refuses RTSP uploads that combine a body with --crlf / CURLOPTCRLF, because the LF→CRLF conversion makes the number of bytes actually sent differ from the Content-Length curl declares to the server. That guard was added as a security fix: - RTSP: commit e84f95a "rtsp: refuse doing...

curl: WebSocket decoder use-after-free when curl_easy_pause() unpauses from a debug callback

Summary At lib/ws.c:503, wsdecpasspayload holds a pointer into the WebSocket receive queue while passing a frame to the application's write callback. If that callback returns CURLWRITEFUNCPAUSE, the PAUSE requested trace invokes the debug callback before the WebSocket pass consumes those bytes...