1312456 matches found
curl: CVE-2026-82209: domain-scoped PSL domain cookie
Summary When libpsl is enabled and a response host is itself a public suffix e.g. github.io, a Set-Cookie header whose Domain attribute exactly equals that host is accepted by psliscookiedomainacceptable but stored with tailmatch = TRUE. RFC 6265 §5.3 requires this exact-match case to produce a...
curl: 12: SASL DIGEST-MD5 does not validate the server's `rspauth` proof
Summary curl never verifies the rspauth value the server sends during SASL DIGEST-MD5 authentication. In Curlsaslcontinue lib/curlsasl.c, the SASLDIGESTMD5RESP handler unconditionally sends an empty acknowledgment without reading or checking the server's continuation data. Authentication then...
curl: 10: CURLOPT_MAXLIFETIME_CONN bypass on active HTTP/2 connections
Summary CURLOPTMAXLIFETIMECONN is not enforced when a new transfer is attached to an active multiplexed HTTP/2 connection. The connection-age eligibility check in urlmatchconn is gated behind !CONNINUSEconn, so an in-use HTTP/2 connection with spare stream capacity is accepted without any age...
curl: 46: `--libcurl` output carries `--insecure` across `--next` boundaries
Summary When --libcurl generates C source for a command that uses --next to separate multiple operations, local options from earlier operations leak into later ones. Specifically, if the first operation uses --insecure and the second does not, the generated program silently skips TLS certificate...
curl: 43: HTTP proxy CONNECT header chooses the `-OJ` filename after a redirect
Summary When curl follows an HTTPS redirect through an HTTP CONNECT proxy, a stale response code lets the proxy's CONNECT response Content-Disposition header control the local output filename. With --location --remote-name --remote-header-name, the proxy-provided filename is used for the...
curl: 34: `curl_mprintf` reads `double` for documented `long double` conversions — uninitialized value disclosure
Summary docs/libcurl/curlmprintf.md documents that the L length modifier makes floating-point conversions %f, %e, %E, %g, %G accept a long double argument. The implementation in lib/mprintf.c recognizes L and sets FLAGSLONGDOUBLE, but the conversion switch %f/%e/%E/%g/%G unconditionally selects...
curl: 36: HTTP upload resume offset consumed twice after early 307/308 redirect
Summary A read-backed HTTP POST using CURLOPTRESUMEFROMLARGE with a non-seekable source silently uploads the wrong data when the server returns a 307 or 308 redirect before the request body is sent. curleasyperform returns CURLEOK, so the caller cannot detect the substitution. The bug is in...
curl: 33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)
Summary After a completed CURLOPTCONNECTONLY transfer, detaching the shared connection pool via curleasysetopteasy, CURLOPTSHARE, NULL causes curleasysend / curleasyrecv to silently operate on an unrelated connection from a different pool. Data intended for server B is sent to server A, and A's...
curl: 27: IMAP custom FETCH listing classification skips literal boundaries, enabling response desynchronization
Summary iscustomfetchlistingmatch in lib/imap.c classifies any custom FETCH whose sequence set contains : or , as a "listing." For that classification, imapstatelistsearchresp skips literal detection entirely. The ping-pong line parser then scans the server-declared literal body as IMAP protocol...
curl: 29: CURLOPT_ISSUERCERT accepts a different-key certificate when issuer metadata collides
Summary osslcheckissuer in lib/vtls/openssl.c uses X509checkissued to implement CURLOPTISSUERCERT. This OpenSSL function checks metadata subject/issuer names, key identifiers, algorithm compatibility, key usage but does not verify the certificate's cryptographic signature. A certificate with...
curl: 28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket
Summary When CURLOPTSOCKOPTFUNCTION returns CURLSOCKOPTALREADYCONNECTED, the HTTP/3 QUIC UDP code path ignores it and calls connect anyway, silently reassociating the application-provided socket to a different peer. The TCP path has the correct check. This violates the documented callback contrac...
curl: Heap-use-after-free in CURLOPT_REFERER when passed a CURLINFO_REFERER pointer
Summary Setting CURLOPTREFERER with a pointer previously obtained from CURLINFOREFERER on the same easy handle triggers a heap-use-after-free. The CURLOPTREFERER handler frees data-state.referer line lib/setopt.c:2089 before Curlsetstropt reads from the now-dangling pointer line...
curl: Stacked --proto modifiers leave denied protocol enabled
Summary proto2num line 431–447 consumes only one leading modifier character via a switch statement. The documentation says entries may be "prefixed by zero or more modifiers." Before commit 86ac471d, a loop consumed all modifiers. The replacement switch reads only the first character. --proto...
curl: --etag-save - truncates append-redirected stdout
Summary saveetag line 267–273 calls fileno, fstat, ftruncatefd, 0 whenever the underlying fd is a regular file. It does not check OutStruct.regularfile, which is FALSE for stdout even when shell-redirected to a file. When --etag-save - is used with append redirection , an HTTP 2xx/3xx response...
curl: CVE-2026-80256: wcurl backslash bypass
A vulnerability was discovered in the wcurl script of the curl project. The vulnerability allowed an attacker-controlled URL to create a new file outside the directory chosen by a Windows user, subject to the user's filesystem permissions and the target not already existing. The vulnerability was...
curl: CVE-2026-80231: native CA store conn reuse
Summary nativecastore is in struct sslconfigdata line 73 of vtlsconfig.h, not sslprimaryconfig. matchsslprimaryconfig does not compare it. On macOS, Curlssleasyconfigcomplete line 258 auto-sets nativecastore = TRUE when no custom CA is configured — without modifying ssloptions. When CURLCABUNDLE ...
curl: CVE-2026-80230: OpenSSL pinning bypass
Summary Curlosslcheckpeercert line 4795 calls SSLget1peercertificate. When no peer certificate is available — as with anonymous cipher suites like AECDH-AES128-SHA — the function returns NULL. The subsequent guard at lines 4798–4799 checks !connconfig-verifypeer || connconfig-verifyhost; when bot...
curl: CVE-2026-80229: OpenSSL provider use-after-free
Summary When CURLOPTSSLENGINE is set e.g. "default" on OpenSSL 3.x, osslsetprovider line 1791 allocates a per-handle OSSLLIBCTX and stores it in data-state.libctx. During TLS connection setup, SSLCTXnewex line 3750 receives this library context and embeds a pointer to it inside the newly created...
curl: OpenSSL ENGINE selection omitted from mTLS connection matching
Summary When an application sets CURLOPTSSLENGINE to select an OpenSSL ENGINE for resolving ENG-type client certificate and private key identifiers, the engine selection is not included in the TLS configuration compared during connection reuse. A second easy handle with a different engine but the...
curl: Unbound cross-peer HTTP Digest challenge state
Summary When libcurl parses an HTTP Digest WWW-Authenticate challenge, it stores the realm, nonce, algorithm, and qop into the easy handle's state.digest — but does not bind that state to the peer that sent it. If the challenge is parsed but never used for output e.g. because Basic or Bearer was...