curl: Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended host

Summary The fix that rejects URL-separator characters introduced by IDN decoding hostnamecheck after hostdecode was applied only to the curlurlget getter path. The transfer path still IDN-decodes the URL host with libidn2 and stores the result without any hostnamecheck. Because libidn2 maps U+FF2...

curl: CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entry

Summary In required netrc mode CURLNETRCREQUIRED, as set by --netrc or --netrc-file, the CURLOPTNETRC documentation says any credential information present in the URL is ignored, but when the configured .netrc file loads successfully yet has no entry matching the requested host and username,...

curl: CVE-2026-115529: Schannel TLS auto client session resumption

Summary: In curl 8.23.0 with Schannel, TLS session resumption preserves an authenticated client certificate identity across a cross-origin redirect even after automatic client certificate selection is disabled. This appears to be an incomplete fix for CVE-2026-86415, where the original fix...

curl: --cert-status with OpenSSL accepts a stapled OCSP response of any age when it lacks nextUpdate (revoked certificate keeps passing)

Summary: curl built with OpenSSL accepts a stapled OCSP "good" response of any age under CURLOPTSSLVERIFYSTATUS --cert-status when the response omits nextUpdate, so a response signed before a certificate was revoked keeps passing the check for as long as the certificate itself is valid. The GnuTL...

curl: Heap-use-after-free in libcurl's multi event machinery (curl_multi_remove_handle() from a socket callback nested under a notify callback)

Summary: The multi interface in libcurl 8.23.0 and current master has a reproducible use-after-free. Inside a CURLMOPTNOTIFYFUNCTION callback, calling curleasypause on a second transfer that is still in flight re-enters libcurl's event handling and invokes the socket callback, where a...

curl: IDN decoding inserts authority delimiters and can redirect proxy CONNECT to a different host

IDN decoding can insert authority delimiters: CURLUPUNYCODE output does not round-trip and proxy requests carry an ambiguous authority Summary libcurl's IDN decoder accepts a hostname containing U+FF20 FULLWIDTH COMMERCIAL AT ＠. libidn2's TR46 transitional fallback converts it to ASCII @...

curl: POP3: data after the end-of-body terminator is written into the retrieved message

Vulnerability Information When a POP3 server sends the end-of-body terminator and further data in the same read, curl writes the bytes after the terminator into the retrieved message's output file and still reports success. The PoC returns the message, its "." line, and then a second "+OK" respon...

curl: A server response that answers nothing is used as the next transfer's reply — and with IMAP, a fully compliant server does this by accident

Name: Maturi Jaswanth Sai Madhu Mohan Product: curl / libcurl — all four pingpong protocols demonstrated: IMAP, POP3, SMTP and FTP — the same protocol set curl's own CVE-2026-92387 names Affected: reproduced on current git master dbb8262a9c 8.23.1-DEV, fetched and rebuilt today, on d1d4b5931a, on...

curl: server filename with control characters printed to terminal (`-J`)

Summary: With -OJ, curl takes the filename from the server's Content-Disposition header. parsefilename in src/toolcbhdr.c does not remove control characters such as ESC 0x1b. When a warning prints that name, the escape sequences reach the terminal. Steps to reproduce 1. Build curl from the source...

curl: HSTS cache file: three trailing dots silently disable HSTS for that host

Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/hsts.c Affected: curl 8.20.0, 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295 / CWE-693, an HSTS pin that silently stops applying Before we...

curl: TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another

Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/vtls/vtlsscache.c Affected: curl 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295, wrong client identity on a resumed TLS session. Same class ...

curl: curl reuses an HTTPS connection when a response is already buffered in the TLS stack

curl master 15292ed75, 8.23.1-DEV reuses an idle HTTP/1.1-over-TLS connection even when a complete extra response is already buffered in OpenSSL/GnuTLS. The ef6b17cf1 fix only polls the socket: Curlcpoolconnseemshealthy lib/conncache.c:1073, called from lib/url.c:1071 uses Curlconnisalive, and...

curl: Pinned public key check passes for a key the server does not hold with the wolfSSL backend

Summary: With the wolfSSL backend, --pinnedpubkey is checked against a public key that curl extracts by re-parsing the server certificate with its own ASN.1 parser lib/vtls/x509asn1.c, while wolfSSL verifies the chain with its own parser. curl 8.23.0 added a check that the validity field of the...

curl: CVE-2026-115528: wolfSSL TLS connect without cert

A vulnerability was discovered in curl when built with wolfSSL that allowed TLS connections to complete without certificate verification. When using default certificate verification settings, curl accepted anonymous Diffie-Hellman cipher suites that transmitted no server certificate. This caused...

curl: urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the host

Summary: six or fewer sentences describing the issue in your own human voice and optionally a short proof-of-concept script An app can set a host from untrusted input from CURLUPARTHOST, as the docs allow, and rely on curl to reject bad hosts. curl accepts fe80::1%[email protected]/x as a valid...

curl: wolfSSL Backend Silently Ignores --cert-status (OCSP Stapling Bypass)

Summary When curl is built with the wolfSSL TLS backend, --cert-status CURLOPTSSLVERIFYSTATUS is silently accepted and ignored. The wolfSSL backend sets certstatusrequest = NULL in its vtable lib/vtls/wolfssl.c:2309, meaning OCSP stapling is not implemented. The curleasysetopt call returns...

curl: Derived cookie Path aborts cookie jar loading in curl 8.23.0

Hello curl security team, I am reporting a related cookie-jar failure that I reproduced on the official curl 8.23.0 release. Summary A server redirects curl to a path approximately 5 KB long and responds there with a short cookie that has no Path attribute. curl derives the cookie path from the...

curl: SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections

The core effect is a silent host-authentication bypass: a transfer whose configured SSH host-key policy would reject the server is served anyway, with exit code 0 and no warning, because it reuses a pooled connection established under a weaker or absent policy. curl may assess this lower because ...

curl: OpenSSL `--cert-status` accepts indefinitely stale GOOD OCSP staples

Summary When curl uses its OpenSSL backend with CURLOPTSSLVERIFYSTATUS the --cert-status tool option, a correctly signed OCSP response can be accepted forever if its optional nextUpdate field is absent. curl passes -1 as OpenSSL's maximum permitted age for thisUpdate, explicitly disabling the onl...

curl: Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc caches

Affected Component - lib/curlfopen.c, Curlfopen, line 98: curlxfopenfilename, FOPENWRITETEXT - Callers: lib/cookie.c:1543 cookie jar save, lib/hsts.c:390 HSTS save, lib/altsvc.c:415 alt-svc save - CLI entry points: -c / --cookie-jar src/config2setopts.c:575, --hsts FILE :714, --alt-svc FILE :711...