curl: CVE-2026-111950: TLS session cache diff scheme reuse

Summary curl 8.12.0 through 8.23.0 can reuse a TLS session created for an FTPS connection when opening an HTTPS connection to the same hostname and port. The TLS session-cache key contains the hostname, port, transport, TLS backend, and TLS configuration, but it does not contain the URL scheme or...

curl: libcurl shared-HSTS-cache race leads to use-after-free with attacker-controlled function-pointer call

Missing lock on the shared HSTS cache in lib/hsts.c CURLLOCKDATAHSTS allows a race that frees an stsentry still referenced by another thread — deterministic same-address reclaim proves the freed object is fully attacker-writable and its destructor pointer is called with an attacker-chosen argumen...

curl: CRLF injection in the HTTP request-line via `CURLOPT_REQUEST_TARGET` (`--request-target`)

Summary The CURLOPTREQUESTTARGET option string reaches the wire with no CR/LF neutralization, even though it is formatted directly into the HTTP request-line, which is terminated by CRLF. Curlsetstropt lib/setopt.c stores the option string after checking only the 8 MB length cap CURLMAXINPUTLENGT...

curl: curl RTSP connection reuse routes response headers to the RTP callback (rtsp_conn state machine not reset between sessions)

Summary libcurl's RTSP client keeps a per-connection RTP parsing state machine in struct rtspconn state, inheader, rtplen, buf. This state machine is initialised exactly once, when a brand-new connection is allocated, and is never reset thereafter. RTSP connections are pooled and reused across...

curl: CRLF injection in the RTSP request-line and Transport header via `CURLOPT_RTSP_STREAM_URI` and `CURLOPT_RTSP_TRANSPORT`

Summary Two RTSP option strings reach the wire with no CR/LF neutralization, even though each is formatted directly into an RTSP request-line or header field that is terminated by CRLF. Curlsetstropt lib/setopt.c stores each option string after checking only the 8 MB length cap CURLMAXINPUTLENGTH...

curl: curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status line

Summary In the HTTP/1.1 proxy-CONNECT response parser lib/cf-h1-proxy.c, singleheader, the per-line counter data-req.headerline a.k.a. k-headerline is never incremented — only the tunnel-local ts-headerlines is. Curlreqsoftreset resets k-headerline to 0 before the CONNECT exchange begins, and it...

curl: OpenSSL provider OSSL_LIB_CTX used after free via the connection shutdown list (CVE-2026-80229 fix incomplete)

Summary: The CVE-2026-80229 fix 7ea37abc6a, 8.22.0 only marks provider connections connclose, but a closed TLS connection is handed to the multi handle's shutdown list lib/conncache.c:242 and outlives its easy handle, while curleasycleanup frees the handle's OSSLLIBCTX osslprovidercleanup,...

curl: CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples

Summary: The CVE-2026-7009 fix 51905671e0 made a missing staple fatal when Apple SecTrust verifies the chain, but when a staple is present curl still skips its own verifystatus lib/vtls/openssl.c:4864-4873, !octx-sectrustverified and leaves the staple to SecTrust. SecTrust evaluates it...

curl: CVE-2026-111878: OpenSSL provider UAF on TLS shutdown

A use-after-free vulnerability was identified in the OpenSSL provider implementation when using the multi interface. The vulnerability occurred when a private library context was freed while an SSL context that borrowed it remained queued for shutdown. This happened because the library context wa...

curl: CVE-2026-111483: GnuTLS accepts non-successful OCSP staples

A vulnerability was identified in curl version 8.22.0 and 8.23.0 when built with GnuTLS. The --cert-status option failed to properly validate stapled OCSP responses. Instead of checking the response status and certificate status within the response, the code only verified that some stapled OCSP...

curl: Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests

Summary: With an HTTP proxy configured, I found that curl sends IPv4 address-literal requests through it with NOPROXY=0.0.0.0/0, and IPv6 address-literal requests through it with NOPROXY=::/0. A zero-bit CIDR prefix should match every address in its family, so those requests should bypass the...

curl: libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request

AI WAS USED IN THE PROCESS OF IDENTIFYING THIS VULNERABILITY. The vulnerability was tested manually and the report was carefully read. Suggested severity Low Affected version curl 8.23.0, tag curl-8230, commit 3163ec065643ba20709f190111f42c3e1fe95273. Affected interface The issue is reachable...

curl: CVE-2026-111482: libssh2 knownhosts prefix match

AI Disclaimer: I've written this report with the help of AI, please feel free to let me know if I made a mistake, I've read the final revision of this report a few times to ensure it was solid but my understanding of the inner workings of curl and libssh is where I can fall short. Summary:...

curl: CVE-2026-111481: server-set cookie still aborts cookie jar

Suggested CWE: CWE-1284: Improper Validation of Specified Quantity in Input H1 didn't let me chose this AI Disclaimer: I've written this report with the help of AI, please feel free to let me know if I made a mistake, I've read the final revision of this report a few times to ensure it was solid...

curl: libcurl TLS shorter-retry mismatch discloses client heap memory during cancelled IMAPS upload

Proof of Concept High-level reproduction: 1. Check out curl 8.22.0 at commit 01346829096c61b372692f6dc43ffa778c6caccd. 2. Build libcurl with either: - rustls-ffi 0.15.4 / rustls 0.23.45; or - GnuTLS 3.8.13. 3. Run the supplied loopback IMAPS server and multi-interface client. 4. The client starts...

curl: FTP authentication options leak to a cross-origin FTP redirect with unrestricted auth disabled

Summary libcurl 8.22.0 sends values configured with CURLOPTFTPACCOUNT and CURLOPTFTPALTERNATIVETOUSER to a different origin reached through an HTTP-to-FTP redirect even when unrestricted authentication is disabled. I reproduced this after a successful legitimate FTP download by reusing the same...

curl: TFTP accepts a first response from an IP other than the requested server

Summary: When curl sends a TFTP request to the IP in the URL, it accepts the first valid response from any source IP and pins that sender as the transfer peer. A host that can get UDP packets to the client's ephemeral port and win this first-response race can receive bytes from a TFTP upload or...

curl: CVE-2026-111480: pause UAF from within callback

Summary: cwoutflushchain in lib/cw-out.c keeps a struct cwoutbuf in a local across the application's write callback the loop at lib/cw-out.c:321-344. If the application calls curleasypauseCURLPAUSECONT from a callback while that buffer is being replayed, a nested cwoutflushchain frees it, and the...

curl: CVE-2026-107929: local interface connection reuse mixup

Summary: When CURLOPTINTERFACE is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address...

curl: CVE-2026-107928: info leak uploading over WebSockets with GnuTLS

Summary: When curl is built with GnuTLS, a malicious WebSocket server can make curl -T wss://... send memory past curl's WebSocket send buffer. This is due to an out of bounds read in gtlssend, which doesn't handle if gnutlsrecordsend returns a number of bytes sent greater than the number of byte...