curl: curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode)

Summary curl's non-blocking connection shutdown machinery lib/cshutdn.c is supposed to enforce a 2-second shutdown timeout DEFAULTSHUTDOWNTIMEOUTMS on connections whose peer never answers the graceful shutdown. In curlmultisocketaction event-driven mode the machinery deadlocks: the only code that...

curl: netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections)

Summary curl's redirect credential-leak protection the CURLOPTUNRESTRICTEDAUTH off-by-default guarantee, enforced by Curlauthallowedtoorigin covers three credential sources: a custom Authorization header, CURLOPTUSERNAME/CURLOPTPASSWORD, and cookies. It does not cover credentials read from a .net...

curl: CVE-2026-111951: curl -OJ truncate without filename

In curl versions 8.23.0, 8.22.0, and master branch, a vulnerability was identified in the tool's handling of Content-Disposition headers with the -OJ flag. When a response contained multiple Content-Disposition headers where the first lacked a filename parameter, the tool would create and truncat...

curl: WebSocket send queue use-after-free during nested curl_ws_send()

At lib/ws.c:1734, wsflush borrows a pointer from the outgoing sendbuf and passes it to wssendrawblocking; it skips those bytes only after the send returns. A curlwssend from the WebSocket write callback can be interrupted by a TCP-trace debug callback that calls curlwssend again, and the nested...

curl: SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connection

Summary For SCP/SFTP, curl verifies the server's host key once, during the initial connect state machine, in sshcheckfingerprint — which reads CURLOPTSSHHOSTPUBLICKEYSHA256 / MD5, the CURLOPTSSHKNOWNHOSTS file, and the CURLOPTSSHHOSTKEYFUNCTION callback. That function has exactly one caller,...

curl: CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth

Summary When libcurl tunnels through an HTTP proxy with CONNECT HTTPS-over-proxy, the custom headers set via CURLOPTPROXYHEADER are sent to the proxy once, at tunnel-setup time lib/httpproxy.c:63-83. The connection-reuse decision for a proxied connection, however, does not take proxyheaders into...

curl: RTSP ANNOUNCE/SET_PARAMETER upload with --use-ascii / CURLOPT_TRANSFERTEXT sends more body bytes than the declared Content-Length (incomplete fix of e

Summary curl refuses RTSP uploads that combine a body with --crlf / CURLOPTCRLF, because the LF→CRLF conversion makes the number of bytes actually sent differ from the Content-Length curl declares to the server. That guard was added as a security fix: - RTSP: commit e84f95a "rtsp: refuse doing...

curl: GnuTLS + Apple SecTrust discards authenticated OCSP failure

Summary curl 8.23.0 and current master can accept a TLS certificate despite an explicit CURLOPTSSLVERIFYSTATUS=1 / --cert-status requirement when curl uses the GnuTLS backend together with Apple SecTrust. GnuTLS correctly marks an invalid or revoked stapled OCSP response as invalid. Because a...

curl: WebSocket decoder use-after-free when curl_easy_pause() unpauses from a debug callback

Summary At lib/ws.c:503, wsdecpasspayload holds a pointer into the WebSocket receive queue while passing a frame to the application's write callback. If that callback returns CURLWRITEFUNCPAUSE, the PAUSE requested trace invokes the debug callback before the WebSocket pass consumes those bytes...

curl: SCP upload with --crlf sends more bytes than the size declared to the server (same class curl refused for IMAP CVE-2026-87864 and RTSP)

Summary curl recently started REFUSING uploads that combine a size-declaring protocol with CRLF conversion, because the LF-CRLF expansion makes the number of bytes actually sent differ from the size declared to the server: - IMAP APPEND — CVE-2026-87864, lib/imap.c:885-886: ifdata-set.crlf...

curl: TLS session cache key omits native_ca_store: a session validated with CURLSSLOPT_NATIVE_CA can be resumed by a transfer that disabled it (incomplete f

Summary CVE-2026-11564 fixed the connection pool so that a connection whose certificate was validated with the native CA store is not reused by a later transfer that switched to custom CA material. That same field, nativecastore, is compared for connection reuse but is NOT part of the TLS session...

curl: Redirect to imap/pop3/smtp (SASL) or sftp/scp (libssh) authenticates to the attacker's host with the user's ambient Kerberos credentials

Summary: When curl follows a redirect to an IMAP, POP3 or SMTP URL carrying any userinfo imap://@attacker.example/ is enough, it authenticates to the redirect target with SASL GSSAPI out of the user's default Kerberos credential cache, although no credentials and no authentication method were...

curl: Cross-protocol redirect to imap:// or smtp:// uploads the -F/MIMEPOST form and the custom Authorization/Cookie headers to the redirect target

Summary: When a transfer that posts a multipart form CURLOPTMIMEPOST, the tool's -F follows a redirect to an imap:// URL, curl APPENDs the whole form to the mailbox on the redirect target and puts the application's CURLOPTHTTPHEADER list into the mail headers, including custom Authorization: and...

curl: OpenSSL+Apple SecTrust: SecTrust accepts certificates that the app's CURLOPT_SSL_CTX_FUNCTION trust store or verify callback rejected

Summary: On OpenSSL builds with Apple SecTrust USEAPPLESECTRUST, for example Homebrew's curl, libcurl runs the handshake with SSLVERIFYNONE, calls the application's CURLOPTSSLCTXFUNCTION before it, and, if OpenSSL's verification fails, asks Apple SecTrust and accepts the server when SecTrust trus...

curl: CVE-2026-111954: upload reader failed redirect UAF

Summary: Curlreqhardreset lib/request.c line 124 in curl-8230 calls Curlclientreset while req-rewindread may still be set, which keeps the client reader stack for a rewind lib/sendf.c line 82, and only clears the flag at line 157, so the kept stack is never rewound or freed and is still installed...

curl: CVE-2026-11586 fix is incomplete: auto-PONG memory grows without limit through curl_ws_recv() (CONNECT_ONLY)

Summary: The CVE-2026-11586 fix 849317ff5c, "ws: make pong sending lazy" adds the automatic PONG only when the WebSocket send buffer has room, but it put that check in wsflush lib/ws.c:1712. curlwsrecv, the receive call of the documented CONNECTONLY model, still calls wsencaddpending without it a...

curl: passive FTPS data connection handshake blocks curl_multi_perform() with no timeout (regression in 8.19.0)

Summary: On a passive FTPS transfer libcurl runs the TLS handshake of the data connection inside a blocking Curlconnconnect call after the server's 150 lib/ftp.c line 550 in curl-8230, ftpinitiatetransfer, and that blocking loop lib/connect.c line 334 bounds itself with Curltimeleftmsdata, which...

curl: CVE-2026-111953: GnuTLS SecTrust OCSP staple bypass

Summary: When curl is built with GnuTLS and Apple SecTrust, as MacPorts does for curl +gnutls +sectrust, a failed GnuTLS verification is handed to SecTrust, and if SecTrust accepts the chain the GnuTLS result is dropped lib/vtls/gtls.c:1511-1521 in 8.23.0. SecTrust is called without the stapled...

curl: CVE-2026-111952: OpenSSL provider use-after-free again

Summary Since 8.23.0, libcurl caches its OpenSSL certificate store per multi handle even when CURLOPTCAPATH is set. OpenSSL loads CApath certificates lazily during verification, and they belong to the library context of the transfer that loaded them. With CURLOPTSSLENGINE that is a private...

curl: wolfSSL TLS sessions retain native-CA trust after the application narrows trust

Summary In curl 8.23.0 with the wolfSSL backend, a TLS session authenticated while the build-default native CA store is active can be resumed after the application changes the same easy handle to a policy that disables native trust. The second transfer succeeds and exchanges HTTP data even though...