curl: Rustls backend discloses out-of-bounds heap data during legal IMAP upload cancellation

Affected: Rustls-backed libcurl, curl 8.8.0 through 8.22.0 and current 8.23 development Summary A malicious IMAP server can apply TLS socket backpressure during an APPEND upload. If the application then legally removes the active easy handle from its multi handle, curl's IMAP cleanup sends a...

curl: libcurl: Secure=1 cookie flag bypasses the 8.22.0 fix and leaks over HTTP

Summary: An HTTPS server can send Set-Cookie: session=lab; Secure=1; Path=/, and curl stores it without the Secure flag, so a later HTTP request to the same host sends session=lab in cleartext. I reproduced this with 8.22.0 and master bb348b35 8.23.0-DEV; the ordinary Secure attribute stays...

curl: Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade

CWE-416 → CWE-908/CWE-200 Aset yang terdampak Affected Asset - Component: libcurl — lib/setopt.c, CURLOPTREFERER handler curleasysetopt API - Related code paths: lib/bufref.c Curlbufreffree, CURLINFOREFERER getter lib/getinfo.c:145, referer emission lib/http.c:2941-2945, pretransfer sync...

curl: IMAP literal size truncation on 32-bit platforms corrupts downloads and desynchronizes the response parser

Summary On 32-bit builds of libcurl, the IMAP FETCH handler truncates a server-announced literal size size from curlofft 64-bit to sizet 32-bit when it decides how many already-buffered bytes belong to the literal body. When a malicious or malfunctioning IMAP server announces a literal whose size...

curl: [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames

Summary A malicious or MITM'd FTP server can cause a client using CURLOPTWILDCARDMATCH to download files outside the intended remote directory, by returning a LIST response with a filename containing .. path-traversal sequences. Details In the CURLWCDOWNLOADING state lib/ftp.c:4079-4095, each...

curl: Missing applicability validation allows non-applicable HTTPS RR to reach ECH processing

Summary The HTTPS RR applicability check Curlhttpsrrapplicable is applied before ALPN selection, but the same check is not applied consistently in the ECH initialization paths. When an HTTPS RR is not applicable to the active connection, curl correctly reports it as not applicable and avoids usin...

curl: Windows filename sanitizer misses Unicode COM/LPT reserved device names

Hi all, I found a way for a server-selected Windows filename to bypass curl's reserved DOS device-name sanitizer. With curl -O -J, a Content-Disposition filename such as COM¹, COM², COM³, LPT¹, LPT², or LPT³ is left unchanged, even though Windows treats all six as reserved device names. Curl...

curl: Use-after-free of the internal multi->admin easy handle via the documented CURLMOPT_NOTIFYFUNCTION callback

Summary: curlmultiinit creates an internal easy handle multi-admin and marks it state.internal = TRUE lib/multi.c:248. The CURLMOPTNOTIFYFUNCTION callback is handed that internal handle on CURLMNOTIFYINFOREAD lib/multintfy.c:109, and the option documentation invites callbacks to remove and clean ...

curl: Encoded slash traversal in the IPFS/IPNS URL rewrite escapes the configured gateway namespace

curl 8.22.0's IPFS/IPNS CLI rewrite decodes the user path after its first dot-segment cleanup, then places that decoded path after the configured gateway base and /ipfs/ or /ipns/ namespace. An encoded slash can therefore become a structural separator too late for the first cleanup, and the final...

curl: HTTP/1.1 response framing violation and unsafe connection reuse when transfer decoding is disabled

Summary: libcurl can incorrectly reuse an HTTP/1.1 connection after a response containing both Content-Length and a non-chunked Transfer-Encoding when transfer decoding is disabled with CURLOPTHTTPTRANSFERDECODING = 0L --raw behavior. In this state, libcurl can treat Content-Length as the respons...

curl: Out-of-bounds read in curl_formadd when CURLFORM_NAMELENGTH is explicitly 0

Hi all, I've discovered a heap out-of-bounds read in curlformadd that causes libcurl to silently read past a caller-supplied buffer and transmit the leaked contents to the remote server. It's confirmed under ASan and reachable without violating any documented precondition. Impact An application...

curl: libcurl LDAP LDIF: entry DN and attribute names written without RFC 2849 base64 encoding, allowing server line injection

Summary: curl 8.22.0 base64-encodes LDAP attribute values that aren't RFC 2849 SAFE-STRINGs commit 2ba2fe3540, issue 22339, but the entry DN and the attribute names are still written to the LDIF output verbatim. In lib/openldap.c oldaprecv that's the DN clientwritedata, STRCONST"DN: ", bv.bvval,...

curl: TELNET control and environment data bypass HTTPS-proxy TLS

Hi, I found a way to make libcurl send TELNET credential and environment data in cleartext to a TELNET origin, even when the connection is supposedly protected by an HTTPS proxy tunnel. The tunnel's TLS never sees it. The bug For telnet:// routed through an HTTPS proxy, generic connection setup...

curl: Socket API drops expired timeouts for transfers queued behind a connection limit

Hi all, I found a way to make libcurl silently and permanently drop a transfer's CURLOPTTIMEOUTMS/CURLOPTCONNECTTIMEOUTMS deadline. It happens when that transfer is queued behind a connection-count limit and the application drives libcurl through the event-driven curlmultisocketaction API instead...

Essity: Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████

An unauthenticated API was discovered that allowed reading, writing to, and deleting any user's private chat history on the organization's internal chatbot application. The API had no authentication mechanism in place, allowing an attacker to list all conversations, retrieve the complete message...

curl: TLS session resumption client cert bypass with CURLOPT_SSL_CTX_FUNCTION

AI use Cipher, by Causal Security, was used to find, exploit and confirm this issue. A further check was carried out to establish, as far as is possible from outside the project, that it is neither a duplicate of an existing report or advisory nor documented as intended behaviour. Everything belo...

HackerOne: HackerOne Code sends live password-reset tokens to Segment in automatic page events

A vulnerability was discovered in the HackerOne Code application, where opening a password-reset link automatically sent the complete unused 64-character reset token to Segment as the page loaded, before the reset form was submitted. The token was present in various fields of the Segment page...

Ruby on Rails: Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown

Summary ActionText::Contenttomarkdown escapes text nodes so that a stored rich text body cannot turn into Markdown syntax. Text whose immediate parent is or is exempt from that escaping MarkdownConversion::SKIPESCAPINGPARENTS and is instead kept inert by the delimiter its visitor wraps around it...

curl: HTTP Digest nonce reused across an https→http scheme change on the same handle

Hi all, Last one from my side. Looks like https://hackerone.com/reports/3793260 was not patched completely correctly, and libcurl emit a live Authorization: Digest response computed from a nonce/realm it only ever received over TLS preemptively over plaintext HTTP, on a reused easy handle that...

curl: Apple SecTrust fallback ignores CURLOPT_CRLFILE, letting a revoked cert pass

When libcurl is built with USEAPPLESECTRUST and the native Apple trust store is in use, a certificate that OpenSSL/GnuTLS rejects because it is on the operator's CURLOPTCRLFILE list is re-checked by Apple's SecTrust API instead, and SecTrust is never told about that CRL file at all. The bug...