15705 matches found
curl: CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entry
Summary In required netrc mode CURLNETRCREQUIRED, as set by --netrc or --netrc-file, the CURLOPTNETRC documentation says any credential information present in the URL is ignored, but when the configured .netrc file loads successfully yet has no entry matching the requested host and username,...
curl: --cert-status with OpenSSL accepts a stapled OCSP response of any age when it lacks nextUpdate (revoked certificate keeps passing)
Summary: curl built with OpenSSL accepts a stapled OCSP "good" response of any age under CURLOPTSSLVERIFYSTATUS --cert-status when the response omits nextUpdate, so a response signed before a certificate was revoked keeps passing the check for as long as the certificate itself is valid. The GnuTL...
curl: Heap-use-after-free in libcurl's multi event machinery (curl_multi_remove_handle() from a socket callback nested under a notify callback)
Summary: The multi interface in libcurl 8.23.0 and current master has a reproducible use-after-free. Inside a CURLMOPTNOTIFYFUNCTION callback, calling curleasypause on a second transfer that is still in flight re-enters libcurl's event handling and invokes the socket callback, where a...
curl: IDN decoding inserts authority delimiters and can redirect proxy CONNECT to a different host
IDN decoding can insert authority delimiters: CURLUPUNYCODE output does not round-trip and proxy requests carry an ambiguous authority Summary libcurl's IDN decoder accepts a hostname containing U+FF20 FULLWIDTH COMMERCIAL AT ＠. libidn2's TR46 transitional fallback converts it to ASCII @...
curl: POP3: data after the end-of-body terminator is written into the retrieved message
Vulnerability Information When a POP3 server sends the end-of-body terminator and further data in the same read, curl writes the bytes after the terminator into the retrieved message's output file and still reports success. The PoC returns the message, its "." line, and then a second "+OK" respon...
curl: A server response that answers nothing is used as the next transfer's reply — and with IMAP, a fully compliant server does this by accident
Name: Maturi Jaswanth Sai Madhu Mohan Product: curl / libcurl — all four pingpong protocols demonstrated: IMAP, POP3, SMTP and FTP — the same protocol set curl's own CVE-2026-92387 names Affected: reproduced on current git master dbb8262a9c 8.23.1-DEV, fetched and rebuilt today, on d1d4b5931a, on...
curl: HSTS cache file: three trailing dots silently disable HSTS for that host
Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/hsts.c Affected: curl 8.20.0, 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295 / CWE-693, an HSTS pin that silently stops applying Before we...
curl: TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another
Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/vtls/vtlsscache.c Affected: curl 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295, wrong client identity on a resumed TLS session. Same class ...
curl: curl reuses an HTTPS connection when a response is already buffered in the TLS stack
curl master 15292ed75, 8.23.1-DEV reuses an idle HTTP/1.1-over-TLS connection even when a complete extra response is already buffered in OpenSSL/GnuTLS. The ef6b17cf1 fix only polls the socket: Curlcpoolconnseemshealthy lib/conncache.c:1073, called from lib/url.c:1071 uses Curlconnisalive, and...
curl: Pinned public key check passes for a key the server does not hold with the wolfSSL backend
Summary: With the wolfSSL backend, --pinnedpubkey is checked against a public key that curl extracts by re-parsing the server certificate with its own ASN.1 parser lib/vtls/x509asn1.c, while wolfSSL verifies the chain with its own parser. curl 8.23.0 added a check that the validity field of the...
curl: urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the host
Summary: six or fewer sentences describing the issue in your own human voice and optionally a short proof-of-concept script An app can set a host from untrusted input from CURLUPARTHOST, as the docs allow, and rely on curl to reject bad hosts. curl accepts fe80::1%[email protected]/x as a valid...
curl: wolfSSL Backend Silently Ignores --cert-status (OCSP Stapling Bypass)
Summary When curl is built with the wolfSSL TLS backend, --cert-status CURLOPTSSLVERIFYSTATUS is silently accepted and ignored. The wolfSSL backend sets certstatusrequest = NULL in its vtable lib/vtls/wolfssl.c:2309, meaning OCSP stapling is not implemented. The curleasysetopt call returns...
curl: SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections
The core effect is a silent host-authentication bypass: a transfer whose configured SSH host-key policy would reject the server is served anyway, with exit code 0 and no warning, because it reuses a pooled connection established under a weaker or absent policy. curl may assess this lower because ...
curl: Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc caches
Affected Component - lib/curlfopen.c, Curlfopen, line 98: curlxfopenfilename, FOPENWRITETEXT - Callers: lib/cookie.c:1543 cookie jar save, lib/hsts.c:390 HSTS save, lib/altsvc.c:415 alt-svc save - CLI entry points: -c / --cookie-jar src/config2setopts.c:575, --hsts FILE :714, --alt-svc FILE :711...
curl: curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode)
Summary curl's non-blocking connection shutdown machinery lib/cshutdn.c is supposed to enforce a 2-second shutdown timeout DEFAULTSHUTDOWNTIMEOUTMS on connections whose peer never answers the graceful shutdown. In curlmultisocketaction event-driven mode the machinery deadlocks: the only code that...
curl: WebSocket send queue use-after-free during nested curl_ws_send()
At lib/ws.c:1734, wsflush borrows a pointer from the outgoing sendbuf and passes it to wssendrawblocking; it skips those bytes only after the send returns. A curlwssend from the WebSocket write callback can be interrupted by a TCP-trace debug callback that calls curlwssend again, and the nested...
curl: SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connection
Summary For SCP/SFTP, curl verifies the server's host key once, during the initial connect state machine, in sshcheckfingerprint — which reads CURLOPTSSHHOSTPUBLICKEYSHA256 / MD5, the CURLOPTSSHKNOWNHOSTS file, and the CURLOPTSSHHOSTKEYFUNCTION callback. That function has exactly one caller,...
curl: CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth
Summary When libcurl tunnels through an HTTP proxy with CONNECT HTTPS-over-proxy, the custom headers set via CURLOPTPROXYHEADER are sent to the proxy once, at tunnel-setup time lib/httpproxy.c:63-83. The connection-reuse decision for a proxied connection, however, does not take proxyheaders into...
curl: RTSP ANNOUNCE/SET_PARAMETER upload with --use-ascii / CURLOPT_TRANSFERTEXT sends more body bytes than the declared Content-Length (incomplete fix of e
Summary curl refuses RTSP uploads that combine a body with --crlf / CURLOPTCRLF, because the LF→CRLF conversion makes the number of bytes actually sent differ from the Content-Length curl declares to the server. That guard was added as a security fix: - RTSP: commit e84f95a "rtsp: refuse doing...
curl: WebSocket decoder use-after-free when curl_easy_pause() unpauses from a debug callback
Summary At lib/ws.c:503, wsdecpasspayload holds a pointer into the WebSocket receive queue while passing a frame to the application's write callback. If that callback returns CURLWRITEFUNCPAUSE, the PAUSE requested trace invokes the debug callback before the WebSocket pass consumes those bytes...
curl: SCP upload with --crlf sends more bytes than the size declared to the server (same class curl refused for IMAP CVE-2026-87864 and RTSP)
Summary curl recently started REFUSING uploads that combine a size-declaring protocol with CRLF conversion, because the LF-CRLF expansion makes the number of bytes actually sent differ from the size declared to the server: - IMAP APPEND — CVE-2026-87864, lib/imap.c:885-886: ifdata-set.crlf...
curl: TLS session cache key omits native_ca_store: a session validated with CURLSSLOPT_NATIVE_CA can be resumed by a transfer that disabled it (incomplete f
Summary CVE-2026-11564 fixed the connection pool so that a connection whose certificate was validated with the native CA store is not reused by a later transfer that switched to custom CA material. That same field, nativecastore, is compared for connection reuse but is NOT part of the TLS session...
curl: Redirect to imap/pop3/smtp (SASL) or sftp/scp (libssh) authenticates to the attacker's host with the user's ambient Kerberos credentials
Summary: When curl follows a redirect to an IMAP, POP3 or SMTP URL carrying any userinfo imap://@attacker.example/ is enough, it authenticates to the redirect target with SASL GSSAPI out of the user's default Kerberos credential cache, although no credentials and no authentication method were...
curl: CVE-2026-11586 fix is incomplete: auto-PONG memory grows without limit through curl_ws_recv() (CONNECT_ONLY)
Summary: The CVE-2026-11586 fix 849317ff5c, "ws: make pong sending lazy" adds the automatic PONG only when the WebSocket send buffer has room, but it put that check in wsflush lib/ws.c:1712. curlwsrecv, the receive call of the documented CONNECTONLY model, still calls wsencaddpending without it a...
curl: passive FTPS data connection handshake blocks curl_multi_perform() with no timeout (regression in 8.19.0)
Summary: On a passive FTPS transfer libcurl runs the TLS handshake of the data connection inside a blocking Curlconnconnect call after the server's 150 lib/ftp.c line 550 in curl-8230, ftpinitiatetransfer, and that blocking loop lib/connect.c line 334 bounds itself with Curltimeleftmsdata, which...
curl: libcurl shared-HSTS-cache race leads to use-after-free with attacker-controlled function-pointer call
Missing lock on the shared HSTS cache in lib/hsts.c CURLLOCKDATAHSTS allows a race that frees an stsentry still referenced by another thread — deterministic same-address reclaim proves the freed object is fully attacker-writable and its destructor pointer is called with an attacker-chosen argumen...
curl: CRLF injection in the HTTP request-line via `CURLOPT_REQUEST_TARGET` (`--request-target`)
Summary The CURLOPTREQUESTTARGET option string reaches the wire with no CR/LF neutralization, even though it is formatted directly into the HTTP request-line, which is terminated by CRLF. Curlsetstropt lib/setopt.c stores the option string after checking only the 8 MB length cap CURLMAXINPUTLENGT...
curl: curl RTSP connection reuse routes response headers to the RTP callback (rtsp_conn state machine not reset between sessions)
Summary libcurl's RTSP client keeps a per-connection RTP parsing state machine in struct rtspconn state, inheader, rtplen, buf. This state machine is initialised exactly once, when a brand-new connection is allocated, and is never reset thereafter. RTSP connections are pooled and reused across...
curl: CRLF injection in the RTSP request-line and Transport header via `CURLOPT_RTSP_STREAM_URI` and `CURLOPT_RTSP_TRANSPORT`
Summary Two RTSP option strings reach the wire with no CR/LF neutralization, even though each is formatted directly into an RTSP request-line or header field that is terminated by CRLF. Curlsetstropt lib/setopt.c stores each option string after checking only the 8 MB length cap CURLMAXINPUTLENGTH...
curl: curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status line
Summary In the HTTP/1.1 proxy-CONNECT response parser lib/cf-h1-proxy.c, singleheader, the per-line counter data-req.headerline a.k.a. k-headerline is never incremented — only the tunnel-local ts-headerlines is. Curlreqsoftreset resets k-headerline to 0 before the CONNECT exchange begins, and it...
curl: Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests
Summary: With an HTTP proxy configured, I found that curl sends IPv4 address-literal requests through it with NOPROXY=0.0.0.0/0, and IPv6 address-literal requests through it with NOPROXY=::/0. A zero-bit CIDR prefix should match every address in its family, so those requests should bypass the...
curl: libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request
AI WAS USED IN THE PROCESS OF IDENTIFYING THIS VULNERABILITY. The vulnerability was tested manually and the report was carefully read. Suggested severity Low Affected version curl 8.23.0, tag curl-8230, commit 3163ec065643ba20709f190111f42c3e1fe95273. Affected interface The issue is reachable...
curl: libcurl TLS shorter-retry mismatch discloses client heap memory during cancelled IMAPS upload
Proof of Concept High-level reproduction: 1. Check out curl 8.22.0 at commit 01346829096c61b372692f6dc43ffa778c6caccd. 2. Build libcurl with either: - rustls-ffi 0.15.4 / rustls 0.23.45; or - GnuTLS 3.8.13. 3. Run the supplied loopback IMAPS server and multi-interface client. 4. The client starts...
curl: TFTP accepts a first response from an IP other than the requested server
Summary: When curl sends a TFTP request to the IP in the URL, it accepts the first valid response from any source IP and pins that sender as the transfer peer. A host that can get UDP packets to the client's ephemeral port and win this first-response race can receive bytes from a TFTP upload or...
curl: CVE-2026-107929: local interface connection reuse mixup
Summary: When CURLOPTINTERFACE is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address...
curl: CVE-2026-107928: info leak uploading over WebSockets with GnuTLS
Summary: When curl is built with GnuTLS, a malicious WebSocket server can make curl -T wss://... send memory past curl's WebSocket send buffer. This is due to an out of bounds read in gtlssend, which doesn't handle if gnutlsrecordsend returns a number of bytes sent greater than the number of byte...
curl: HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)
Since 8.22.0 libcurl reuses an idle HTTP/1.1 connection that already has unread bytes waiting on it, as long as the pool health check ran less than a second ago, and those bytes are then returned as the response to the next request sent on that connection, so every later response on it is shifted...
curl: Cookie attribute truncation in curl drops Secure/HttpOnly protections
Description: If a Set-Cookie header contains an = immediately after a semicolon i.e., ;=, curl stops parsing the attributes and discards everything that follows. This silently drops protections like Secure and HttpOnly, causing curl to later send the cookie over unencrypted HTTP. Root Cause: In...
curl: Rustls backend discloses out-of-bounds heap data during legal IMAP upload cancellation
Affected: Rustls-backed libcurl, curl 8.8.0 through 8.22.0 and current 8.23 development Summary A malicious IMAP server can apply TLS socket backpressure during an APPEND upload. If the application then legally removes the active easy handle from its multi handle, curl's IMAP cleanup sends a...
Ruby on Rails: ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754
Vulnerability description not provided...
curl: libcurl: Secure=1 cookie flag bypasses the 8.22.0 fix and leaks over HTTP
Summary: An HTTPS server can send Set-Cookie: session=lab; Secure=1; Path=/, and curl stores it without the Secure flag, so a later HTTP request to the same host sends session=lab in cleartext. I reproduced this with 8.22.0 and master bb348b35 8.23.0-DEV; the ordinary Secure attribute stays...
HackerOne: HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks
A password reset token was transmitted to a real user monitoring service before the reset form was submitted. The token was passed as a query string parameter in the URL and recorded by the monitoring SDK without any redaction. The same monitoring session also captured the account identifier afte...
Essity: Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor data
An unauthenticated self-registration endpoint was discovered on an internal supplier procurement portal. The registration form was fully functional and accessible without any invitation, approval code, or affiliation verification. A test account was successfully created and confirmed via email...
curl: Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade
CWE-416 → CWE-908/CWE-200 Aset yang terdampak Affected Asset - Component: libcurl — lib/setopt.c, CURLOPTREFERER handler curleasysetopt API - Related code paths: lib/bufref.c Curlbufreffree, CURLINFOREFERER getter lib/getinfo.c:145, referer emission lib/http.c:2941-2945, pretransfer sync...
curl: curl tool: --hsts is ignored for a schemeless URL starting with a slash under --proto-default http
Summary When the curl tool gets --proto-default http and a URL without a scheme that starts with a slash, such as /example.com/path, it skips all the options set in httpsetopts: --hsts, --alt-svc, the cookie options, -L and the rest. libcurl still performs the transfer, over plain HTTP. Unless an...
curl: IMAP literal size truncation on 32-bit platforms corrupts downloads and desynchronizes the response parser
Summary On 32-bit builds of libcurl, the IMAP FETCH handler truncates a server-announced literal size size from curlofft 64-bit to sizet 32-bit when it decides how many already-buffered bytes belong to the literal body. When a malicious or malfunctioning IMAP server announces a literal whose size...
curl: [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames
Summary A malicious or MITM'd FTP server can cause a client using CURLOPTWILDCARDMATCH to download files outside the intended remote directory, by returning a LIST response with a filename containing .. path-traversal sequences. Details In the CURLWCDOWNLOADING state lib/ftp.c:4079-4095, each...
WordPress: Information Disclosure - Unauthen Leak Private Content
A vulnerability was discovered in the BuddyPress integration of a forum plugin where the hidesitewide flag for new topic and reply activity was computed by checking only the posting forum's own status, not its parent forums. This allowed topics posted in a public-status subforum nested under a...
curl: Missing applicability validation allows non-applicable HTTPS RR to reach ECH processing
Summary The HTTPS RR applicability check Curlhttpsrrapplicable is applied before ALPN selection, but the same check is not applied consistently in the ECH initialization paths. When an HTTPS RR is not applicable to the active connection, curl correctly reports it as not applicable and avoids usin...
curl: CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL
A .netrc-sourced password, injected into the live URL handle at login time, survives an ordinary same-host relative Location: redirect and ends up verbatim in data-state.url, so it is exposed via CURLINFOEFFECTIVEURL, curl -w '%urleffective', and verbose -v output. Affected code...