curl: 50: CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usable

Summary The CMake HTTPONLY=ON option is documented as "Disable all protocols except HTTP" CMakeLists.txt:538, but the implementation CMakeLists.txt:541-557 only sets CURLDISABLE flags for non-SSH protocols. It does not disable CURLUSELIBSSH2 or CURLUSELIBSSH. Since CURLUSELIBSSH2 defaults to ON, ...

curl: 42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions

Summary VMSSTS in src/toolvms.h line 46 uses a comparison 3 where a left-shift 3 is intended. This causes VMSSTSHIDE to evaluate to 0x10000001 instead of 0x10000000, setting bit 0 the OpenVMS success bit. When curl runs under DCL with --silent and without --show-error, the mask is ORed into the...

curl: 41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

Summary When curl is launched with stdin fd 0 and stderr fd 2 closed, maincheckfds in src/toolmain.c can assign opposite ends of the same pipe to fd 0 and fd 2. In verbose mode with a stdin-based upload through an authenticated proxy, the Proxy-Authorization header written to stderr becomes...

curl: 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface

Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface Summary When a proxy is configured with a literal link-local IPv6 address and an explicit zone ID e.g. http://fe80::1%25eth0:8080, curl parses and stores the zone correctly but never applies it to the socket...

curl: 07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verification

GnuTLS 0-RTT early data bypasses file-backed public-key pin verification Summary When CURLSSLOPTEARLYDATA is enabled and CURLOPTPINNEDPUBLICKEY references a file path, replacing that file's contents between connections does not invalidate the TLS session cache. On the next connection, curl sends...

curl: 06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

Summary Curlvtlsappleverify in lib/vtls/apple.c passes the stapled OCSP response to SecTrustSetOCSPResponse only when both HAVEBUILTINAVAILABLE and SUPPORTSSecOCSP are defined. When HAVEBUILTINAVAILABLE is absent, the OCSP buffer is silently discarded. GCC does not support builtinavailable, so th...

curl: CVE-2026-82208: wolfSSL CA-cache hit overrides callback

Summary With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, curl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then...

curl: CVE-2026-80255: secure cookie attribute bypass with tab

Summary A Set-Cookie header using HTAB horizontal tab instead of SPACE before the Secure attribute — e.g. Set-Cookie: sid=SECRET;\tSecure — causes curl to store the cookie without its Secure flag. The cookie is then sent over plaintext HTTP on subsequent requests to the same host. The...

curl: CVE-2026-82209: domain-scoped PSL domain cookie

Summary When libpsl is enabled and a response host is itself a public suffix e.g. github.io, a Set-Cookie header whose Domain attribute exactly equals that host is accepted by psliscookiedomainacceptable but stored with tailmatch = TRUE. RFC 6265 §5.3 requires this exact-match case to produce a...

curl: 46: `--libcurl` output carries `--insecure` across `--next` boundaries

Summary When --libcurl generates C source for a command that uses --next to separate multiple operations, local options from earlier operations leak into later ones. Specifically, if the first operation uses --insecure and the second does not, the generated program silently skips TLS certificate...

curl: 34: `curl_mprintf` reads `double` for documented `long double` conversions — uninitialized value disclosure

Summary docs/libcurl/curlmprintf.md documents that the L length modifier makes floating-point conversions %f, %e, %E, %g, %G accept a long double argument. The implementation in lib/mprintf.c recognizes L and sets FLAGSLONGDOUBLE, but the conversion switch %f/%e/%E/%g/%G unconditionally selects...

curl: 33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

Summary After a completed CURLOPTCONNECTONLY transfer, detaching the shared connection pool via curleasysetopteasy, CURLOPTSHARE, NULL causes curleasysend / curleasyrecv to silently operate on an unrelated connection from a different pool. Data intended for server B is sent to server A, and A's...

curl: 28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket

Summary When CURLOPTSOCKOPTFUNCTION returns CURLSOCKOPTALREADYCONNECTED, the HTTP/3 QUIC UDP code path ignores it and calls connect anyway, silently reassociating the application-provided socket to a different peer. The TCP path has the correct check. This violates the documented callback contrac...

curl: Stacked --proto modifiers leave denied protocol enabled

Summary proto2num line 431–447 consumes only one leading modifier character via a switch statement. The documentation says entries may be "prefixed by zero or more modifiers." Before commit 86ac471d, a loop consumed all modifiers. The replacement switch reads only the first character. --proto...

curl: --etag-save - truncates append-redirected stdout

Summary saveetag line 267–273 calls fileno, fstat, ftruncatefd, 0 whenever the underlying fd is a regular file. It does not check OutStruct.regularfile, which is FALSE for stdout even when shell-redirected to a file. When --etag-save - is used with append redirection , an HTTP 2xx/3xx response...

curl: CVE-2026-80256: wcurl backslash bypass

A vulnerability was discovered in the wcurl script of the curl project. The vulnerability allowed an attacker-controlled URL to create a new file outside the directory chosen by a Windows user, subject to the user's filesystem permissions and the target not already existing. The vulnerability was...

curl: CVE-2026-80231: native CA store conn reuse

Summary nativecastore is in struct sslconfigdata line 73 of vtlsconfig.h, not sslprimaryconfig. matchsslprimaryconfig does not compare it. On macOS, Curlssleasyconfigcomplete line 258 auto-sets nativecastore = TRUE when no custom CA is configured — without modifying ssloptions. When CURLCABUNDLE ...

curl: CVE-2026-80230: OpenSSL pinning bypass

Summary Curlosslcheckpeercert line 4795 calls SSLget1peercertificate. When no peer certificate is available — as with anonymous cipher suites like AECDH-AES128-SHA — the function returns NULL. The subsequent guard at lines 4798–4799 checks !connconfig-verifypeer || connconfig-verifyhost; when bot...

curl: CVE-2026-80229: OpenSSL provider use-after-free

Summary When CURLOPTSSLENGINE is set e.g. "default" on OpenSSL 3.x, osslsetprovider line 1791 allocates a per-handle OSSLLIBCTX and stores it in data-state.libctx. During TLS connection setup, SSLCTXnewex line 3750 receives this library context and embeds a pointer to it inside the newly created...

curl: Unbound cross-peer HTTP Digest challenge state

Summary When libcurl parses an HTTP Digest WWW-Authenticate challenge, it stores the realm, nonce, algorithm, and qop into the easy handle's state.digest — but does not bind that state to the peer that sent it. If the challenge is parsed but never used for output e.g. because Basic or Bearer was...

curl: ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

cleanarg operates on char str, which is the UTF-8 copy allocated by converttchartoUTF8. It has no reference to the original wchart argv element. c / toolgetparam.c:632 / static void cleanargchar str / now that getstr has copied the contents of nextarg, wipe the next argument out so that the...

curl: curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack

Summary: CURLSH the curl share handle allows multiple easy handles to share state — cookies, DNS cache, SSL sessions, connection cache — across threads. The share is protected by optional user-supplied mutex callbacks CURLSHOPTLOCKFUNC / CURLSHOPTUNLOCKFUNC. When a caller invokes curlsharesetopts...

curl: TLS session cache case-folds CA paths and bypasses the active trust profile

curl 8.21.0 case-folds the entire TLS session-cache peer key, so two distinct CA files whose Unix paths differ only by case can share a TLS session ticket. At lib/vtls/vtlsscache.c:723, curlstrequal compares keys that include case-sensitive CA, CRL, and issuer paths, even though...

curl: wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0

Summary When curl is built against wolfSSL, setting CURLOPTSSLVERIFYPEER=0 causes a hostname-mismatched certificate to be accepted even though CURLOPTSSLVERIFYHOST remains at its default enabled setting. I built wolfSSL from source, built curl against it, and connected to a TLS server presenting ...

curl: RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions

Summary libcurl's RTSP code interpolates the values of CURLOPTRTSPSTREAMURI, CURLOPTRTSPTRANSPORT, and CURLOPTRTSPSESSIONID directly into the RTSP request text with no check for embedded CR/LF, so a value containing \r\n splits one intended RTSP operation into multiple independent RTSP requests o...

curl: libcurl Digest/NTLM authentication ignores an explicit Authorization header

Summary When an application sets an explicit Authorization header via CURLOPTHTTPHEADER while libcurl also has credentials configured and HTTP Digest or NTLM authentication is selected/challenged, libcurl does not honor the application's header as a replacement — it sends its own internally...

curl: Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts

When curl loads a cookie file written as raw HTTP Set-Cookie: header lines and a line has no Domain attribute, the cookie is stored with co-domain == NULL, because a file import has no request-host to scope it to. On the send side, Curlcookiegetlist accepts any cookie in the bucket whose domain i...

curl: libcurl cache updates follow symlinks and truncate their targets

Summary: When curl updates an HSTS, Alt-Svc, or cookie cache, it opens the supplied path with "w" before validating it, so a symlink path can truncate the file it targets. Root cause: Curlfopen calls curlxfopenfilename, "w" before checking the path or creating the safe temporary file, and fopen...

curl: Windows SSPI connection-pool probe can reuse a connection under the wrong user

Summary : A fresh transfer can reuse a keep-alive connection authenticated under another Windows user because the SSPI isolation check trusts a connection ID that a health probe can set. Root cause : Curlcpoolconnseemshealthy calls Curlattachconnection, which sets data-state.recentconnid, while...

WordPress: Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`

A vulnerability was discovered in the WordPress media processing functionality. This vulnerability allowed an authenticated author to delete arbitrary files on the server. The vulnerability was caused by insufficient input validation in the finalizeitem function, which allowed an attacker to...

WordPress: Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`

A vulnerability was discovered in the WordPress media upload and finalize endpoints. An author could upload a crafted image with a malicious filename, which was then stored verbatim by the endpoint and rendered without proper escaping in the WordPress admin media library. This could allow the...

Myndr: Myndr CORS Misconfiguration

The CORS configuration on admin.myndr.net allowed any .myndr.net subdomain to read authenticated admin panel responses, including CSRF nonces and session data. This vulnerability could have been exploited to take over admin accounts...

curl: CVE-2026-19931: Negotiate ambient user conn reuse

Summary On Windows with SSPI/Negotiate, curl 8.21.0 can reuse a connection authenticated with ambient credentials for a later request using different explicit credentials. In urlmatchauthnego, the credential comparison is skipped when conn-creds == NULL. This allows a connection authenticated as...

curl: URL API: triple-slash parses path segment as hostname

Summary libcurl's URL API misparses http:///host/path. Per RFC 3986, the authority between // and / is empty, so /host/path is the path. But parseurl in lib/urlapi.c treats the first segment as the hostname. On line 1087, the slash counter i reaches 3, which is within the valid 1-3 range, and hos...

curl: Cookie jar load skips public suffix check on PSL builds

On curl 8.21.0 with libpsl official curl.se 8.21.06 win64, Features: PSL, HTTP Set-Cookie: Domain=co.uk is dropped in verbose. The same cookie loaded from a Netscape jar file or a Set-Cookie: line in that file is accepted and later sent to unrelated hosts under the suffix bank.co.uk, other.co.uk...

curl: curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session Hijacking

Summary curl's Curlwsaccept function in lib/ws.c processes the 101 Switching Protocols response to a client WebSocket upgrade request. RFC 6455 Section 4.1 mandates that the client MUST verify the Sec-WebSocket-Accept response header by computing the SHA-1 hash of the concatenation of the...

curl: CVE-2026-18924: HTTP/2 server push UAF

A vulnerability was discovered in libcurl versions 8.21.0 and later, where a use-after-free issue could occur in the HTTP/2 server push functionality. The vulnerability was caused by the fact that when a pushed transfer ends, the connection's pool is not properly handled, leading to the freed...

curl: Heap use-after-free (write) in mev_forget_socket() via reentrant curl_easy_pause() — incomplete fix for CVE-2026-9080

lib/multiev.c keeps a hash table multi-ev.shentries of per-socket bookkeeping structs struct mevshentry used to decide when to notify the application's socket callback CURLMOPTSOCKETFUNCTION about interest changes on a socket. CVE-2026-9080 "multi: handle pause in multi socket callback", commit...

curl: SMTP CRLF injection in custom SMTP recipient operand allows additional SMTP commands after authentication

Summary During testing of curl 8.18.0, I observed that CRLF characters embedded in the SMTP recipient operand used with a custom SMTP request are transmitted as additional SMTP commands. The injected commands are accepted and processed after successful SMTP authentication, allowing multiple SMTP...

IBM: Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint

A vertical privilege escalation vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated...

Weblate: Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate

A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the pyparsing library. The grammar was ambiguous at every position and did not enable memoization,...

8x8: @jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)

An unsafe nginx regex pattern was discovered in the /colibri-relay-ws/ location of the @jitsi/docker-jitsi-meet project. The regex a-zA-Z0-9-\.+ accepted arbitrary domain names and IP addresses for proxypass directives, allowing unauthenticated requests to be proxied to attacker-specified...

Weblate: SSRF via URL Parser Differential in `normalize_request_url` (wlc)

The Weblate CLI client wlc was found to be vulnerable to Server-Side Request Forgery SSRF due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalizerequesturl function, which was meant to validate that outgoing API requests stayed...

Liberapay: Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat

A vulnerability was discovered in the unauthenticated team "income/payments" export feature of Liberapay. The vulnerability allowed an attacker to retrieve donor identity, exact donation amount, and donation dates for public donors, bypassing the donor's explicit privacy settings such as...

Essity: Unauthenticated SQL Injection via REST Batch Route Confusion ████████

A vulnerability was discovered in the WordPress REST API batch endpoint /wp-json/batch/v1 on a certain website. The vulnerability allowed unauthenticated blind SQL injection by nesting a crafted batch payload, which triggered a route-dispatch desynchronization. This caused a user-controlled strin...

Rocket.Chat: Stored HTML Injection (CWE-79) via Livechat Visitor Name

Vulnerability description not provided...

Weblate: **Unauthenticated IDOR allows modification of payment customer billing information**

The application contained an access control issue in the payment billing information edit functionality. An unauthenticated user was able to access the payment edit endpoint and modify the billing information associated with a payment without any authorization check. The issue occurred because th...

8x8: connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)

A deserialization vulnerability was reported in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an...

8x8: connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step Outputs

An input validation issue was reported in the 8x8 Connect Automation Builder's API where workflow step output field names were not validated against reserved context variable names. The issue was addressed by implementing validation to reject reserved field names at workflow creation...

Node.js: Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

A flaw was discovered in the synchronous Node.js zlib APIs that allowed a spoofed TypedArray byteLength to trigger a reachable assertion, causing the entire process to crash. All 11 synchronous zlib functions were affected...