curl: libcurl LDAP LDIF: entry DN and attribute names written without RFC 2849 base64 encoding, allowing server line injection

Summary: curl 8.22.0 base64-encodes LDAP attribute values that aren't RFC 2849 SAFE-STRINGs commit 2ba2fe3540, issue 22339, but the entry DN and the attribute names are still written to the LDIF output verbatim. In lib/openldap.c oldaprecv that's the DN clientwritedata, STRCONST"DN: ", bv.bvval,...

curl: CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints

Hi all, I found a way for a server to defeat --remote-header-name's -J no-clobber guarantee: with curl -O -J -i, sending a 103 Early Hints before the final response or an ETag ahead of Content-Disposition under --etag-save lets a server overwrite an existing file it names via Content-Disposition,...

curl: CVE-2026-92389: TFTP direction confusion

Hi all, curl's TFTP state machine accepts either direction's opening response regardless of which one was requested. A malicious TFTP server can answer an RRQ with ACK block 0, which flips curl into transmit mode and causes it to drain whatever read source the handle's sticky CURLOPTREADDATA poin...

Weblate: Uncaught RecursionError crash in translation-finder (deep directory tree DoS)

A denial of service vulnerability was discovered in a translation discovery tool where uncaught recursion errors could crash processing during repository scanning. The issue occurred when scanning directories nested approximately 1000 levels deep, which exceeded the Python recursion limit and...

curl: CVE-2026-92388: FTP wildcard write callback mixup

Hi all, A failed FTP wildcard LIST leaves data-set.fwritefunc pointing at libcurl's internal listing parser and data-set.out pointing at the easy handle itself, because the code path that restores them is only reached on a successful listing. That alone is a crash on reuse. However,...

curl: CVE-2026-92387: never-ending loop via server response omission

Hi all, I found a way to make a malicious FTP, IMAP, POP3, or SMTP server defeat libcurl's own transfer timeout entirely and, worse, freeze every other transfer sharing the same multi handle. All it takes is never sending a final control-response line. The bug Curlppstatemach checks the response...

curl: CVE-2026-92386: server-set cookie aborts cookie jar load

Hi all, I found a way for a remote server to poison a shared cookie jar so that later, unrelated transfers fail before any network I/O happens. It just has to send a Set-Cookie that curl happily accepts but can never read back from its own jar file. The bug parsecookieheader accepts a Set-Cookie...

curl: TELNET control and environment data bypass HTTPS-proxy TLS

Hi, I found a way to make libcurl send TELNET credential and environment data in cleartext to a TELNET origin, even when the connection is supposedly protected by an HTTPS proxy tunnel. The tunnel's TLS never sees it. The bug For telnet:// routed through an HTTPS proxy, generic connection setup...

curl: Socket API drops expired timeouts for transfers queued behind a connection limit

Hi all, I found a way to make libcurl silently and permanently drop a transfer's CURLOPTTIMEOUTMS/CURLOPTCONNECTTIMEOUTMS deadline. It happens when that transfer is queued behind a connection-count limit and the application drives libcurl through the event-driven curlmultisocketaction API instead...

curl: IMAP custom FETCH literals can spoof tagged responses and desynchronize reused connections

Summary There is an IMAP parser vulnerability, related to a custom FETCH whose message set begins with a range or comma, iscustomfetchlisting causes imapstatelistsearchresp to skip literal parsing lib/imap.c:1233-1235. The generic ping-pong reader nevertheless continues parsing the response as...

Essity: Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████

An unauthenticated API was discovered that allowed reading, writing to, and deleting any user's private chat history on the organization's internal chatbot application. The API had no authentication mechanism in place, allowing an attacker to list all conversations, retrieve the complete message...

curl: TLS session resumption client cert bypass with CURLOPT_SSL_CTX_FUNCTION

AI use Cipher, by Causal Security, was used to find, exploit and confirm this issue. A further check was carried out to establish, as far as is possible from outside the project, that it is neither a duplicate of an existing report or advisory nor documented as intended behaviour. Everything belo...

curl: One Strict-Transport-Security response header empties the victim's entire HSTS store, silently,

Summary One Strict-Transport-Security response header, from any HTTPS server the victim contacts, leaves the victim's on-disk HSTS store at zero bytes. Every host in it loses HSTS protection, including hosts unrelated to the server that sent the header. curl exits 0 and prints nothing. Two...

HackerOne: HackerOne Code sends live password-reset tokens to Segment in automatic page events

A vulnerability was discovered in the HackerOne Code application, where opening a password-reset link automatically sent the complete unused 64-character reset token to Segment as the page loaded, before the reset form was submitted. The token was present in various fields of the Segment page...

R3: Full Admin Takeover of R3 Limited's JFrog Artifactory - 292 Users, Corda Enterprise & CBDC Supply Chain Compromised

A critical authentication bypass vulnerability was identified in an enterprise artifact repository system. The vulnerability, with a CVSS score of 9.8, resulted from a default empty join key that allowed unauthenticated attackers to forge authentication tokens and gain full administrative access...

Ruby on Rails: Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown

Summary ActionText::Contenttomarkdown escapes text nodes so that a stored rich text body cannot turn into Markdown syntax. Text whose immediate parent is or is exempt from that escaping MarkdownConversion::SKIPESCAPINGPARENTS and is instead kept inert by the delimiter its visitor wraps around it...

curl: HTTP Digest nonce reused across an https→http scheme change on the same handle

Hi all, Last one from my side. Looks like https://hackerone.com/reports/3793260 was not patched completely correctly, and libcurl emit a live Authorization: Digest response computed from a nonce/realm it only ever received over TLS preemptively over plaintext HTTP, on a reused easy handle that...

curl: CVE-2026-86415: auto client cert connection reuse mixup

Howdy, libcurl's connection-cache matcher never checks autoclientcert, so a cached, already-authenticated Schannel connection can be handed to a transfer that just got redirected to a different origin, even though the code explicitly computed autoclientcert = FALSE for that transfer to prevent...

curl: Apple SecTrust fallback ignores CURLOPT_CRLFILE, letting a revoked cert pass

When libcurl is built with USEAPPLESECTRUST and the native Apple trust store is in use, a certificate that OpenSSL/GnuTLS rejects because it is on the operator's CURLOPTCRLFILE list is re-checked by Apple's SecTrust API instead, and SecTrust is never told about that CRL file at all. The bug...

curl: CVE-2026-86414: leaking host credentials to HTTP proxy

Hi all, I've found that found that an untrusted HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate instead of the expected 407 Proxy-Authenticate...