curl: OpenSSL provider OSSL_LIB_CTX used after free via the connection shutdown list (CVE-2026-80229 fix incomplete)

Summary: The CVE-2026-80229 fix 7ea37abc6a, 8.22.0 only marks provider connections connclose, but a closed TLS connection is handed to the multi handle's shutdown list lib/conncache.c:242 and outlives its easy handle, while curleasycleanup frees the handle's OSSLLIBCTX osslprovidercleanup,...

curl: CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples

Summary: The CVE-2026-7009 fix 51905671e0 made a missing staple fatal when Apple SecTrust verifies the chain, but when a staple is present curl still skips its own verifystatus lib/vtls/openssl.c:4864-4873, !octx-sectrustverified and leaves the staple to SecTrust. SecTrust evaluates it...

curl: CVE-2026-111878: OpenSSL provider UAF on TLS shutdown

A use-after-free vulnerability was identified in the OpenSSL provider implementation when using the multi interface. The vulnerability occurred when a private library context was freed while an SSL context that borrowed it remained queued for shutdown. This happened because the library context wa...

curl: CVE-2026-111483: GnuTLS accepts non-successful OCSP staples

A vulnerability was identified in curl version 8.22.0 and 8.23.0 when built with GnuTLS. The --cert-status option failed to properly validate stapled OCSP responses. Instead of checking the response status and certificate status within the response, the code only verified that some stapled OCSP...

curl: Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests

Summary: With an HTTP proxy configured, I found that curl sends IPv4 address-literal requests through it with NOPROXY=0.0.0.0/0, and IPv6 address-literal requests through it with NOPROXY=::/0. A zero-bit CIDR prefix should match every address in its family, so those requests should bypass the...

curl: libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request

AI WAS USED IN THE PROCESS OF IDENTIFYING THIS VULNERABILITY. The vulnerability was tested manually and the report was carefully read. Suggested severity Low Affected version curl 8.23.0, tag curl-8230, commit 3163ec065643ba20709f190111f42c3e1fe95273. Affected interface The issue is reachable...

curl: CVE-2026-111482: libssh2 knownhosts prefix match

AI Disclaimer: I've written this report with the help of AI, please feel free to let me know if I made a mistake, I've read the final revision of this report a few times to ensure it was solid but my understanding of the inner workings of curl and libssh is where I can fall short. Summary:...

curl: CVE-2026-111481: server-set cookie still aborts cookie jar

Suggested CWE: CWE-1284: Improper Validation of Specified Quantity in Input H1 didn't let me chose this AI Disclaimer: I've written this report with the help of AI, please feel free to let me know if I made a mistake, I've read the final revision of this report a few times to ensure it was solid...

curl: libcurl TLS shorter-retry mismatch discloses client heap memory during cancelled IMAPS upload

Proof of Concept High-level reproduction: 1. Check out curl 8.22.0 at commit 01346829096c61b372692f6dc43ffa778c6caccd. 2. Build libcurl with either: - rustls-ffi 0.15.4 / rustls 0.23.45; or - GnuTLS 3.8.13. 3. Run the supplied loopback IMAPS server and multi-interface client. 4. The client starts...

curl: FTP authentication options leak to a cross-origin FTP redirect with unrestricted auth disabled

Summary libcurl 8.22.0 sends values configured with CURLOPTFTPACCOUNT and CURLOPTFTPALTERNATIVETOUSER to a different origin reached through an HTTP-to-FTP redirect even when unrestricted authentication is disabled. I reproduced this after a successful legitimate FTP download by reusing the same...

curl: TFTP accepts a first response from an IP other than the requested server

Summary: When curl sends a TFTP request to the IP in the URL, it accepts the first valid response from any source IP and pins that sender as the transfer peer. A host that can get UDP packets to the client's ephemeral port and win this first-response race can receive bytes from a TFTP upload or...

curl: CVE-2026-111480: pause UAF from within callback

Summary: cwoutflushchain in lib/cw-out.c keeps a struct cwoutbuf in a local across the application's write callback the loop at lib/cw-out.c:321-344. If the application calls curleasypauseCURLPAUSECONT from a callback while that buffer is being replayed, a nested cwoutflushchain frees it, and the...

curl: CVE-2026-107929: local interface connection reuse mixup

Summary: When CURLOPTINTERFACE is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address...

curl: CVE-2026-107928: info leak uploading over WebSockets with GnuTLS

Summary: When curl is built with GnuTLS, a malicious WebSocket server can make curl -T wss://... send memory past curl's WebSocket send buffer. This is due to an out of bounds read in gtlssend, which doesn't handle if gnutlsrecordsend returns a number of bytes sent greater than the number of byte...

curl: HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)

Since 8.22.0 libcurl reuses an idle HTTP/1.1 connection that already has unread bytes waiting on it, as long as the pool health check ran less than a second ago, and those bytes are then returned as the response to the next request sent on that connection, so every later response on it is shifted...

Weblate: Billion laughs entity expansion in Qt .ts discovery: a crafted ~950 KB file forces ~55 MB of XML expansion per parse, cost scales with crafted file c

An XML entity expansion vulnerability was discovered in the Qt translation discovery backend of a software component. The vulnerability existed in a function that parsed Qt .ts files using default entity processing without proper restrictions. An attacker could craft malicious .ts files with...

curl: Cookie attribute truncation in curl drops Secure/HttpOnly protections

Description: If a Set-Cookie header contains an = immediately after a semicolon i.e., ;=, curl stops parsing the attributes and discards everything that follows. This silently drops protections like Secure and HttpOnly, causing curl to later send the cookie over unencrypted HTTP. Root Cause: In...

Weblate: CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matching

A CPU-based denial of service vulnerability was identified in a translation file discovery library. The vulnerability resulted from inefficient algorithmic complexity in wildcard mask matching operations. When processing directories or archives containing multiple files sharing the same suffix, t...

curl: Rustls backend discloses out-of-bounds heap data during legal IMAP upload cancellation

Affected: Rustls-backed libcurl, curl 8.8.0 through 8.22.0 and current 8.23 development Summary A malicious IMAP server can apply TLS socket backpressure during an APPEND upload. If the application then legally removes the active easy handle from its multi handle, curl's IMAP cleanup sends a...

Ruby on Rails: ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754

Vulnerability description not provided...

AWS VDP: Unescaped consent-prompt renderer (HTML()) enables concealed-approval OS command injection in strands-agents/tools use_computer — RCE

A vulnerability was discovered in an agent tool framework where user consent prompts were rendered without proper escaping. Markup embedded in tool arguments was interpreted rather than displayed, allowing attackers to conceal malicious commands within prompts that appeared benign to operators...

curl: libcurl: Secure=1 cookie flag bypasses the 8.22.0 fix and leaks over HTTP

Summary: An HTTPS server can send Set-Cookie: session=lab; Secure=1; Path=/, and curl stores it without the Secure flag, so a later HTTP request to the same host sends session=lab in cleartext. I reproduced this with 8.22.0 and master bb348b35 8.23.0-DEV; the ordinary Secure attribute stays...

HackerOne: HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks

A password reset token was transmitted to a real user monitoring service before the reset form was submitted. The token was passed as a query string parameter in the URL and recorded by the monitoring SDK without any redaction. The same monitoring session also captured the account identifier afte...

Essity: Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor data

An unauthenticated self-registration endpoint was discovered on an internal supplier procurement portal. The registration form was fully functional and accessible without any invitation, approval code, or affiliation verification. A test account was successfully created and confirmed via email...

curl: Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade

CWE-416 → CWE-908/CWE-200 Aset yang terdampak Affected Asset - Component: libcurl — lib/setopt.c, CURLOPTREFERER handler curleasysetopt API - Related code paths: lib/bufref.c Curlbufreffree, CURLINFOREFERER getter lib/getinfo.c:145, referer emission lib/http.c:2941-2945, pretransfer sync...

curl: curl tool: --hsts is ignored for a schemeless URL starting with a slash under --proto-default http

Summary When the curl tool gets --proto-default http and a URL without a scheme that starts with a slash, such as /example.com/path, it skips all the options set in httpsetopts: --hsts, --alt-svc, the cookie options, -L and the rest. libcurl still performs the transfer, over plain HTTP. Unless an...

Django: `Vary` cache-key conflation of absent and empty request fields

A cache-key generation vulnerability was identified in Django's cache middleware that conflated absent and empty request fields nominated by Vary headers. When a request header was absent versus present with an empty value, the same cache key was generated, causing responses intended for one...

curl: IMAP literal size truncation on 32-bit platforms corrupts downloads and desynchronizes the response parser

Summary On 32-bit builds of libcurl, the IMAP FETCH handler truncates a server-announced literal size size from curlofft 64-bit to sizet 32-bit when it decides how many already-buffered bytes belong to the literal body. When a malicious or malfunctioning IMAP server announces a literal whose size...

curl: [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames

Summary A malicious or MITM'd FTP server can cause a client using CURLOPTWILDCARDMATCH to download files outside the intended remote directory, by returning a LIST response with a filename containing .. path-traversal sequences. Details In the CURLWCDOWNLOADING state lib/ftp.c:4079-4095, each...

WordPress: Information Disclosure - Unauthen Leak Private Content

A vulnerability was discovered in the BuddyPress integration of a forum plugin where the hidesitewide flag for new topic and reply activity was computed by checking only the posting forum's own status, not its parent forums. This allowed topics posted in a public-status subforum nested under a...

curl: Missing applicability validation allows non-applicable HTTPS RR to reach ECH processing

Summary The HTTPS RR applicability check Curlhttpsrrapplicable is applied before ALPN selection, but the same check is not applied consistently in the ECH initialization paths. When an HTTPS RR is not applicable to the active connection, curl correctly reports it as not applicable and avoids usin...

Weblate: Translation discovery crashes on crafted filenames (regex substitution injection)

A translation discovery package was vulnerable to a regular expression injection attack through crafted filenames. When processing repository files, the package interpolated user-controlled filename components into regex replacement strings without proper escaping. Filenames containing backslash...

WordPress: CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content

A vulnerability was discovered in CampTix where the view token used to gate private content was derived from an attendee's email address and the requester's IP address. This allowed an attacker who knew an attendee's email address to gain access to gated content without possessing a valid ticket...

curl: CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL

A .netrc-sourced password, injected into the live URL handle at login time, survives an ordinary same-host relative Location: redirect and ends up verbatim in data-state.url, so it is exposed via CURLINFOEFFECTIVEURL, curl -w '%urleffective', and verbose -v output. Affected code...

curl: Windows filename sanitizer misses Unicode COM/LPT reserved device names

Hi all, I found a way for a server-selected Windows filename to bypass curl's reserved DOS device-name sanitizer. With curl -O -J, a Content-Disposition filename such as COM¹, COM², COM³, LPT¹, LPT², or LPT³ is left unchanged, even though Windows treats all six as reserved device names. Curl...

curl: CVE-2026-94265: Authorization: Negotiate sent to foreign origin

Hi all, I've discovered that curl can be made to send an "Authorization: Negotiate" header, carrying a freshly minted Kerberos ticket for the victim's ambient identity, to a host chosen by an HTTP redirect, without --location-trusted. All the attacker has to do is put arbitrary userinfo in the...

Weblate: wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.

The wlc command-line client did not properly handle filesystem errors, which caused two distinct issues. First, when project-wide downloads failed partway through, already-written archives were left on disk with no report of which components succeeded or failed, making it impossible to distinguis...

Node.js: Keep-alive socket process a response that was written before the request was sent

A flaw was discovered in HTTP Agent connection reuse where a client could accept a response that was sent before the request was transmitted. This occurred because the guard that destroys idle keep-alive sockets when unexpected data arrives only ran when the event loop polled for I/O. If an...

Node.js: dns.resolve truncates names containing NUL char

A patch for CVE-2026-48930 was found to be incomplete. The fix rejected embedded NUL bytes in DNS lookup entry points but failed to apply the same validation to dns.resolve entry points that interface with c-ares binding. When a NUL character was passed within a hostname to dns.resolve4, the call...

Node.js: TLS certificate hostname bypass when the IP is written fullwidth digits

A flaw was discovered in TLS hostname verification that allowed a certificate without a matching IP address to authenticate connections when the host was written using non-ASCII characters. The verification function failed to recognize such hosts as IP addresses and instead matched them against...

Weblate: Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.

A translation management application contained incomplete VCS metadata exclusion in its ZIP download feature. The exclusion mechanism only covered Git and Mercurial metadata directories but failed to exclude Subversion and Bazaar metadata directories. This gap allowed Subversion and Bazaar metada...

Basecamp: Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses

A vulnerability was discovered in HEY's email service that allowed ordinary users to send authenticated emails from arbitrary HEY addresses without authorization. An attacker could create a temporary external account claiming any target HEY address using unrelated SMTP credentials, enqueue a...

curl: Use-after-free of the internal multi->admin easy handle via the documented CURLMOPT_NOTIFYFUNCTION callback

Summary: curlmultiinit creates an internal easy handle multi-admin and marks it state.internal = TRUE lib/multi.c:248. The CURLMOPTNOTIFYFUNCTION callback is handed that internal handle on CURLMNOTIFYINFOREAD lib/multintfy.c:109, and the option documentation invites callbacks to remove and clean ...

curl: Retry-independent time-condition HTTP/2 UAF

Relationship to the original report This is a supplemental trigger for HackerOne report 4030333, not a claim of an unrelated vulnerability. It reaches the same stale Curleasy condition through normal time-condition handling and shows that a fix limited to the original retry path is incomplete...

curl: CVE-2026-92392: HTTP/2 upload Use-After-Free

Summary: During a file upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object. The control flow is a bit complicated, so I've produced an ASCII tree of the control flow to highlight the...

WordPress: WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses

A password protection bypass was identified in a REST API wrapper for recurring events. The wrapper endpoint exposed RSVP attendee roster data without verifying password authentication, while the core API correctly enforced password gates. Unauthenticated requests could retrieve attendee names,...

Weblate: Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()`

A memory exhaustion vulnerability was discovered in the encoding detection function that loaded entire files into memory without size restrictions. The vulnerability affected the translation discovery process, where a single large translation file could cause peak memory usage to reach...

curl: Encoded slash traversal in the IPFS/IPNS URL rewrite escapes the configured gateway namespace

curl 8.22.0's IPFS/IPNS CLI rewrite decodes the user path after its first dot-segment cleanup, then places that decoded path after the configured gateway base and /ipfs/ or /ipns/ namespace. An encoded slash can therefore become a structural separator too late for the first cleanup, and the final...

curl: HTTP/1.1 response framing violation and unsafe connection reuse when transfer decoding is disabled

Summary: libcurl can incorrectly reuse an HTTP/1.1 connection after a response containing both Content-Length and a non-chunked Transfer-Encoding when transfer decoding is disabled with CURLOPTHTTPTRANSFERDECODING = 0L --raw behavior. In this state, libcurl can treat Content-Length as the respons...

curl: Out-of-bounds read in curl_formadd when CURLFORM_NAMELENGTH is explicitly 0

Hi all, I've discovered a heap out-of-bounds read in curlformadd that causes libcurl to silently read past a caller-supplied buffer and transmit the leaked contents to the remote server. It's confirmed under ASan and reachable without violating any documented precondition. Impact An application...