Khan Academy: Client-Side Denial of Service (DoS) via Memory Exhaustion on Password Reset Endpoint

A client-side denial of service vulnerability was identified on a password reset endpoint. When the endpoint was accessed by an authenticated user, the browser automatically generated thousands of requests without user interaction, resulting in rapid memory exhaustion. The browser became...

curl: IMAP connection reuse runs requests in the wrong case-sensitive mailbox

When libcurl reuses an authenticated IMAP connection, lib/imap.c:2071-2089 uses curlstrequal to decide whether the requested mailbox is already selected. RFC 9051 section 5.1 requires clients to work with servers where non-INBOX mailbox names are case-sensitive, while only INBOX is guaranteed to ...

curl: 56: IBM i CL wrapper `parse_command_line()` never enters quote mode

Summary In projects/OS400/curlcl.c, the parsecommandline function initializes quote to '\0' but no code path ever assigns an opening ' or " to it. The close-quote check line 82, quote-aware backslash handling line 88, and unterminated-quote error line 106 are all dead code. As a result, quote...

curl: 55: Heap-buffer-overflow read in `curl_formadd_ccsid()` with binary form data

Summary curlformaddccsid in projects/OS400/ccsidcurl.c performs a heap-buffer-overflow read when CURLFORMCONTENTTYPE appears before an explicit length CURLFORMCONTENTLEN / CURLFORMCONTENTSLENGTH for binary CURLFORMCOPYCONTENTS data containing embedded NUL bytes. The overread bytes are copied into...

curl: 53: HTTP/1 CONNECT chunked-407 trailers bypass CURLOPT_SUPPRESS_CONNECT_HEADERS and lose CURLH_CONNECT classification

Summary When an HTTP/1 proxy returns a chunked 407 Proxy Authentication Required during a CONNECT handshake, any trailer fields in that response are delivered to the header callback even when CURLOPTSUPPRESSCONNECTHEADERS is enabled, and are classified as CURLHTRAILER instead of CURLHCONNECT in t...

curl: 50: CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usable

Summary The CMake HTTPONLY=ON option is documented as "Disable all protocols except HTTP" CMakeLists.txt:538, but the implementation CMakeLists.txt:541-557 only sets CURLDISABLE flags for non-SSH protocols. It does not disable CURLUSELIBSSH2 or CURLUSELIBSSH. Since CURLUSELIBSSH2 defaults to ON, ...

curl: 57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()`

Summary curleasyescapeccsid and curleasyunescapeccsid in projects/OS400/ccsidcurl.c discard the converted byte count returned by dynconvert and pass 0 to the downstream curleasyescape / curleasyunescape. When the caller supplies a positive explicit length with non-NUL-terminated input, dynconvert...

curl: 54: Rejected HTTP/2 push destroys MIME callback state still used by parent (use-after-free)

Summary pushpromise in lib/http2.c duplicates the parent easy handle before validating the pushed URL. When validation fails e.g. unsupported scheme, discardnewhandle destroys the duplicate. For callback-backed MIME uploads, Curlmimeduppart copies the same readfunc, freefunc, and arg pointer, so...

curl: 49: Cookie-jar save transfers group access to a different GID

Summary Curlfopen copies the old cookie jar's permission bits onto a newly created temp file, but the temp file may receive a different GID the process's primary group instead of the old file's group. After rename, group-permission bits that were intended for one group now authorize a different...

curl: 42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions

Summary VMSSTS in src/toolvms.h line 46 uses a comparison 3 where a left-shift 3 is intended. This causes VMSSTSHIDE to evaluate to 0x10000001 instead of 0x10000000, setting bit 0 the OpenVMS success bit. When curl runs under DCL with --silent and without --show-error, the mask is ORed into the...

curl: 41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

Summary When curl is launched with stdin fd 0 and stderr fd 2 closed, maincheckfds in src/toolmain.c can assign opposite ends of the same pipe to fd 0 and fd 2. In verbose mode with a stdin-based upload through an authenticated proxy, the Proxy-Authorization header written to stderr becomes...

curl: 37: `curl_mprintf` `%F` format specifier not consumed, causing variadic argument desynchronization

Summary docs/libcurl/curlmprintf.md documents %F as a conversion that consumes a double, alongside %f. However, parseconversion in lib/mprintf.c has no F case — it falls through to the default branch and returns without assigning an input slot. In a sequential format like "%F%s", the %s conversio...

curl: 22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal

Summary When CURLOPTWILDCARDMATCH is enabled, libcurl concatenates the server-provided LIST filename directly onto the wildcard path and then URL-decodes the combined string. A filename containing percent-encoded path separators e.g. %2e%2e%2fsecret.txt is decoded into ../secret.txt, causing...

curl: 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface

Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface Summary When a proxy is configured with a literal link-local IPv6 address and an explicit zone ID e.g. http://fe80::1%25eth0:8080, curl parses and stores the zone correctly but never applies it to the socket...

curl: 11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes first

Summary When HTTP/2 transfers share a multiplexed connection, CURLOPTFORBIDREUSE set by a transfer that completes before the other active streams is silently discarded. The connection survives into the idle pool and can be reused by a subsequent transfer. This breaks the mitigation documented in...

curl: 08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust path

Summary The fix for CVE-2026-7009 commit 51905671e0 does not cover AWS-LC. In osslappleverify in lib/vtls/openssl.c, a missing OCSP staple is detected only when SSLgettlsextstatusocspresp returns a negative length. OpenSSL returns -1 for absence, but AWS-LC returns 0 with a NULL output pointer. O...

curl: 07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verification

GnuTLS 0-RTT early data bypasses file-backed public-key pin verification Summary When CURLSSLOPTEARLYDATA is enabled and CURLOPTPINNEDPUBLICKEY references a file path, replacing that file's contents between connections does not invalidate the TLS session cache. On the next connection, curl sends...

curl: 06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

Summary Curlvtlsappleverify in lib/vtls/apple.c passes the stapled OCSP response to SecTrustSetOCSPResponse only when both HAVEBUILTINAVAILABLE and SUPPORTSSecOCSP are defined. When HAVEBUILTINAVAILABLE is absent, the OCSP buffer is silently discarded. GCC does not support builtinavailable, so th...

curl: CVE-2026-82208: wolfSSL CA-cache hit overrides callback

Summary With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, curl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then...

curl: CVE-2026-80255: secure cookie attribute bypass with tab

Summary A Set-Cookie header using HTAB horizontal tab instead of SPACE before the Secure attribute — e.g. Set-Cookie: sid=SECRET;\tSecure — causes curl to store the cookie without its Secure flag. The cookie is then sent over plaintext HTTP on subsequent requests to the same host. The...