curl: POP3: data after the end-of-body terminator is written into the retrieved message

Vulnerability Information When a POP3 server sends the end-of-body terminator and further data in the same read, curl writes the bytes after the terminator into the retrieved message's output file and still reports success. The PoC returns the message, its "." line, and then a second "+OK" respon...

curl: HSTS cache file: three trailing dots silently disable HSTS for that host

Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/hsts.c Affected: curl 8.20.0, 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295 / CWE-693, an HSTS pin that silently stops applying Before we...

curl: TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another

Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/vtls/vtlsscache.c Affected: curl 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295, wrong client identity on a resumed TLS session. Same class ...

curl: curl reuses an HTTPS connection when a response is already buffered in the TLS stack

curl master 15292ed75, 8.23.1-DEV reuses an idle HTTP/1.1-over-TLS connection even when a complete extra response is already buffered in OpenSSL/GnuTLS. The ef6b17cf1 fix only polls the socket: Curlcpoolconnseemshealthy lib/conncache.c:1073, called from lib/url.c:1071 uses Curlconnisalive, and...

curl: urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the host

Summary: six or fewer sentences describing the issue in your own human voice and optionally a short proof-of-concept script An app can set a host from untrusted input from CURLUPARTHOST, as the docs allow, and rely on curl to reject bad hosts. curl accepts fe80::1%[email protected]/x as a valid...

curl: wolfSSL Backend Silently Ignores --cert-status (OCSP Stapling Bypass)

Summary When curl is built with the wolfSSL TLS backend, --cert-status CURLOPTSSLVERIFYSTATUS is silently accepted and ignored. The wolfSSL backend sets certstatusrequest = NULL in its vtable lib/vtls/wolfssl.c:2309, meaning OCSP stapling is not implemented. The curleasysetopt call returns...

curl: SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections

The core effect is a silent host-authentication bypass: a transfer whose configured SSH host-key policy would reject the server is served anyway, with exit code 0 and no warning, because it reuses a pooled connection established under a weaker or absent policy. curl may assess this lower because ...

curl: Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc caches

Affected Component - lib/curlfopen.c, Curlfopen, line 98: curlxfopenfilename, FOPENWRITETEXT - Callers: lib/cookie.c:1543 cookie jar save, lib/hsts.c:390 HSTS save, lib/altsvc.c:415 alt-svc save - CLI entry points: -c / --cookie-jar src/config2setopts.c:575, --hsts FILE :714, --alt-svc FILE :711...

curl: WebSocket send queue use-after-free during nested curl_ws_send()

At lib/ws.c:1734, wsflush borrows a pointer from the outgoing sendbuf and passes it to wssendrawblocking; it skips those bytes only after the send returns. A curlwssend from the WebSocket write callback can be interrupted by a TCP-trace debug callback that calls curlwssend again, and the nested...

curl: SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connection

Summary For SCP/SFTP, curl verifies the server's host key once, during the initial connect state machine, in sshcheckfingerprint — which reads CURLOPTSSHHOSTPUBLICKEYSHA256 / MD5, the CURLOPTSSHKNOWNHOSTS file, and the CURLOPTSSHHOSTKEYFUNCTION callback. That function has exactly one caller,...

curl: CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth

Summary When libcurl tunnels through an HTTP proxy with CONNECT HTTPS-over-proxy, the custom headers set via CURLOPTPROXYHEADER are sent to the proxy once, at tunnel-setup time lib/httpproxy.c:63-83. The connection-reuse decision for a proxied connection, however, does not take proxyheaders into...

curl: RTSP ANNOUNCE/SET_PARAMETER upload with --use-ascii / CURLOPT_TRANSFERTEXT sends more body bytes than the declared Content-Length (incomplete fix of e

Summary curl refuses RTSP uploads that combine a body with --crlf / CURLOPTCRLF, because the LF→CRLF conversion makes the number of bytes actually sent differ from the Content-Length curl declares to the server. That guard was added as a security fix: - RTSP: commit e84f95a "rtsp: refuse doing...

curl: WebSocket decoder use-after-free when curl_easy_pause() unpauses from a debug callback

Summary At lib/ws.c:503, wsdecpasspayload holds a pointer into the WebSocket receive queue while passing a frame to the application's write callback. If that callback returns CURLWRITEFUNCPAUSE, the PAUSE requested trace invokes the debug callback before the WebSocket pass consumes those bytes...

curl: SCP upload with --crlf sends more bytes than the size declared to the server (same class curl refused for IMAP CVE-2026-87864 and RTSP)

Summary curl recently started REFUSING uploads that combine a size-declaring protocol with CRLF conversion, because the LF-CRLF expansion makes the number of bytes actually sent differ from the size declared to the server: - IMAP APPEND — CVE-2026-87864, lib/imap.c:885-886: ifdata-set.crlf...

curl: TLS session cache key omits native_ca_store: a session validated with CURLSSLOPT_NATIVE_CA can be resumed by a transfer that disabled it (incomplete f

Summary CVE-2026-11564 fixed the connection pool so that a connection whose certificate was validated with the native CA store is not reused by a later transfer that switched to custom CA material. That same field, nativecastore, is compared for connection reuse but is NOT part of the TLS session...

curl: libcurl shared-HSTS-cache race leads to use-after-free with attacker-controlled function-pointer call

Missing lock on the shared HSTS cache in lib/hsts.c CURLLOCKDATAHSTS allows a race that frees an stsentry still referenced by another thread — deterministic same-address reclaim proves the freed object is fully attacker-writable and its destructor pointer is called with an attacker-chosen argumen...

curl: CRLF injection in the HTTP request-line via `CURLOPT_REQUEST_TARGET` (`--request-target`)

Summary The CURLOPTREQUESTTARGET option string reaches the wire with no CR/LF neutralization, even though it is formatted directly into the HTTP request-line, which is terminated by CRLF. Curlsetstropt lib/setopt.c stores the option string after checking only the 8 MB length cap CURLMAXINPUTLENGT...

curl: curl RTSP connection reuse routes response headers to the RTP callback (rtsp_conn state machine not reset between sessions)

Summary libcurl's RTSP client keeps a per-connection RTP parsing state machine in struct rtspconn state, inheader, rtplen, buf. This state machine is initialised exactly once, when a brand-new connection is allocated, and is never reset thereafter. RTSP connections are pooled and reused across...

curl: CRLF injection in the RTSP request-line and Transport header via `CURLOPT_RTSP_STREAM_URI` and `CURLOPT_RTSP_TRANSPORT`

Summary Two RTSP option strings reach the wire with no CR/LF neutralization, even though each is formatted directly into an RTSP request-line or header field that is terminated by CRLF. Curlsetstropt lib/setopt.c stores each option string after checking only the 8 MB length cap CURLMAXINPUTLENGTH...

curl: curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status line

Summary In the HTTP/1.1 proxy-CONNECT response parser lib/cf-h1-proxy.c, singleheader, the per-line counter data-req.headerline a.k.a. k-headerline is never incremented — only the tunnel-local ts-headerlines is. Curlreqsoftreset resets k-headerline to 0 before the CONNECT exchange begins, and it...

curl: Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests

Summary: With an HTTP proxy configured, I found that curl sends IPv4 address-literal requests through it with NOPROXY=0.0.0.0/0, and IPv6 address-literal requests through it with NOPROXY=::/0. A zero-bit CIDR prefix should match every address in its family, so those requests should bypass the...

curl: libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request

AI WAS USED IN THE PROCESS OF IDENTIFYING THIS VULNERABILITY. The vulnerability was tested manually and the report was carefully read. Suggested severity Low Affected version curl 8.23.0, tag curl-8230, commit 3163ec065643ba20709f190111f42c3e1fe95273. Affected interface The issue is reachable...

curl: libcurl TLS shorter-retry mismatch discloses client heap memory during cancelled IMAPS upload

Proof of Concept High-level reproduction: 1. Check out curl 8.22.0 at commit 01346829096c61b372692f6dc43ffa778c6caccd. 2. Build libcurl with either: - rustls-ffi 0.15.4 / rustls 0.23.45; or - GnuTLS 3.8.13. 3. Run the supplied loopback IMAPS server and multi-interface client. 4. The client starts...

curl: TFTP accepts a first response from an IP other than the requested server

Summary: When curl sends a TFTP request to the IP in the URL, it accepts the first valid response from any source IP and pins that sender as the transfer peer. A host that can get UDP packets to the client's ephemeral port and win this first-response race can receive bytes from a TFTP upload or...

curl: CVE-2026-107929: local interface connection reuse mixup

Summary: When CURLOPTINTERFACE is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address...

curl: CVE-2026-107928: info leak uploading over WebSockets with GnuTLS

Summary: When curl is built with GnuTLS, a malicious WebSocket server can make curl -T wss://... send memory past curl's WebSocket send buffer. This is due to an out of bounds read in gtlssend, which doesn't handle if gnutlsrecordsend returns a number of bytes sent greater than the number of byte...

curl: HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)

Since 8.22.0 libcurl reuses an idle HTTP/1.1 connection that already has unread bytes waiting on it, as long as the pool health check ran less than a second ago, and those bytes are then returned as the response to the next request sent on that connection, so every later response on it is shifted...

curl: Cookie attribute truncation in curl drops Secure/HttpOnly protections

Description: If a Set-Cookie header contains an = immediately after a semicolon i.e., ;=, curl stops parsing the attributes and discards everything that follows. This silently drops protections like Secure and HttpOnly, causing curl to later send the cookie over unencrypted HTTP. Root Cause: In...

curl: Rustls backend discloses out-of-bounds heap data during legal IMAP upload cancellation

Affected: Rustls-backed libcurl, curl 8.8.0 through 8.22.0 and current 8.23 development Summary A malicious IMAP server can apply TLS socket backpressure during an APPEND upload. If the application then legally removes the active easy handle from its multi handle, curl's IMAP cleanup sends a...

Ruby on Rails: ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754

Vulnerability description not provided...

curl: libcurl: Secure=1 cookie flag bypasses the 8.22.0 fix and leaks over HTTP

Summary: An HTTPS server can send Set-Cookie: session=lab; Secure=1; Path=/, and curl stores it without the Secure flag, so a later HTTP request to the same host sends session=lab in cleartext. I reproduced this with 8.22.0 and master bb348b35 8.23.0-DEV; the ordinary Secure attribute stays...

HackerOne: HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks

A password reset token was transmitted to a real user monitoring service before the reset form was submitted. The token was passed as a query string parameter in the URL and recorded by the monitoring SDK without any redaction. The same monitoring session also captured the account identifier afte...

Essity: Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor data

An unauthenticated self-registration endpoint was discovered on an internal supplier procurement portal. The registration form was fully functional and accessible without any invitation, approval code, or affiliation verification. A test account was successfully created and confirmed via email...

curl: Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade

CWE-416 → CWE-908/CWE-200 Aset yang terdampak Affected Asset - Component: libcurl — lib/setopt.c, CURLOPTREFERER handler curleasysetopt API - Related code paths: lib/bufref.c Curlbufreffree, CURLINFOREFERER getter lib/getinfo.c:145, referer emission lib/http.c:2941-2945, pretransfer sync...

curl: curl tool: --hsts is ignored for a schemeless URL starting with a slash under --proto-default http

Summary When the curl tool gets --proto-default http and a URL without a scheme that starts with a slash, such as /example.com/path, it skips all the options set in httpsetopts: --hsts, --alt-svc, the cookie options, -L and the rest. libcurl still performs the transfer, over plain HTTP. Unless an...

curl: IMAP literal size truncation on 32-bit platforms corrupts downloads and desynchronizes the response parser

Summary On 32-bit builds of libcurl, the IMAP FETCH handler truncates a server-announced literal size size from curlofft 64-bit to sizet 32-bit when it decides how many already-buffered bytes belong to the literal body. When a malicious or malfunctioning IMAP server announces a literal whose size...

curl: [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames

Summary A malicious or MITM'd FTP server can cause a client using CURLOPTWILDCARDMATCH to download files outside the intended remote directory, by returning a LIST response with a filename containing .. path-traversal sequences. Details In the CURLWCDOWNLOADING state lib/ftp.c:4079-4095, each...

WordPress: Information Disclosure - Unauthen Leak Private Content

A vulnerability was discovered in the BuddyPress integration of a forum plugin where the hidesitewide flag for new topic and reply activity was computed by checking only the posting forum's own status, not its parent forums. This allowed topics posted in a public-status subforum nested under a...

curl: Missing applicability validation allows non-applicable HTTPS RR to reach ECH processing

Summary The HTTPS RR applicability check Curlhttpsrrapplicable is applied before ALPN selection, but the same check is not applied consistently in the ECH initialization paths. When an HTTPS RR is not applicable to the active connection, curl correctly reports it as not applicable and avoids usin...

curl: CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL

A .netrc-sourced password, injected into the live URL handle at login time, survives an ordinary same-host relative Location: redirect and ends up verbatim in data-state.url, so it is exposed via CURLINFOEFFECTIVEURL, curl -w '%urleffective', and verbose -v output. Affected code...

curl: Windows filename sanitizer misses Unicode COM/LPT reserved device names

Hi all, I found a way for a server-selected Windows filename to bypass curl's reserved DOS device-name sanitizer. With curl -O -J, a Content-Disposition filename such as COM¹, COM², COM³, LPT¹, LPT², or LPT³ is left unchanged, even though Windows treats all six as reserved device names. Curl...

curl: CVE-2026-94265: Authorization: Negotiate sent to foreign origin

Hi all, I've discovered that curl can be made to send an "Authorization: Negotiate" header, carrying a freshly minted Kerberos ticket for the victim's ambient identity, to a host chosen by an HTTP redirect, without --location-trusted. All the attacker has to do is put arbitrary userinfo in the...

Basecamp: Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses

A vulnerability was discovered in HEY's email service that allowed ordinary users to send authenticated emails from arbitrary HEY addresses without authorization. An attacker could create a temporary external account claiming any target HEY address using unrelated SMTP credentials, enqueue a...

curl: Use-after-free of the internal multi->admin easy handle via the documented CURLMOPT_NOTIFYFUNCTION callback

Summary: curlmultiinit creates an internal easy handle multi-admin and marks it state.internal = TRUE lib/multi.c:248. The CURLMOPTNOTIFYFUNCTION callback is handed that internal handle on CURLMNOTIFYINFOREAD lib/multintfy.c:109, and the option documentation invites callbacks to remove and clean ...

curl: Retry-independent time-condition HTTP/2 UAF

Relationship to the original report This is a supplemental trigger for HackerOne report 4030333, not a claim of an unrelated vulnerability. It reaches the same stale Curleasy condition through normal time-condition handling and shows that a fix limited to the original retry path is incomplete...

curl: CVE-2026-92392: HTTP/2 upload Use-After-Free

Summary: During a file upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object. The control flow is a bit complicated, so I've produced an ASCII tree of the control flow to highlight the...

Weblate: Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()`

A memory exhaustion vulnerability was discovered in the encoding detection function that loaded entire files into memory without size restrictions. The vulnerability affected the translation discovery process, where a single large translation file could cause peak memory usage to reach...

curl: Encoded slash traversal in the IPFS/IPNS URL rewrite escapes the configured gateway namespace

curl 8.22.0's IPFS/IPNS CLI rewrite decodes the user path after its first dot-segment cleanup, then places that decoded path after the configured gateway base and /ipfs/ or /ipns/ namespace. An encoded slash can therefore become a structural separator too late for the first cleanup, and the final...

curl: HTTP/1.1 response framing violation and unsafe connection reuse when transfer decoding is disabled

Summary: libcurl can incorrectly reuse an HTTP/1.1 connection after a response containing both Content-Length and a non-chunked Transfer-Encoding when transfer decoding is disabled with CURLOPTHTTPTRANSFERDECODING = 0L --raw behavior. In this state, libcurl can treat Content-Length as the respons...

curl: Out-of-bounds read in curl_formadd when CURLFORM_NAMELENGTH is explicitly 0

Hi all, I've discovered a heap out-of-bounds read in curlformadd that causes libcurl to silently read past a caller-supplied buffer and transmit the leaked contents to the remote server. It's confirmed under ASan and reachable without violating any documented precondition. Impact An application...