Browse / curl

curl

See its reports on the map

What gets reported to curl

• Memory Corruption163
• Information Disclosure95
• Cryptography74
• Injection and Smuggling66
• Authentication54
• Business Logic52

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Use-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction)DuplicateUse After Free · high
   58 votes
2. Negotiate connection reuse with wrong credentials when using CURLAUTH_ANY DuplicateAuthentication Bypass by Primary Weakness · medium
   45 votes
3. Negotiate Authentication Premature on Connection ReuseDuplicateImproper Authentication - Generic · high
   39 votes
4. Kerberos/SPNEGO Connection Reuse VulnerabilityDuplicate
   22 votes
5. SMTP CRLF Command Injection in CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPTDuplicateCRLF Injection · medium
   11 votes
6. Heap Buffer Over-Read via Malicious SMB Server READ_ANDX ResponseDuplicateOut-of-bounds Read · medium
   9 votes
7. Retry-independent time-condition HTTP/2 UAFDuplicateUse After Free
   6 votes
8. IMAP custom FETCH literals can spoof tagged responses and desynchronize reused connectionsDuplicateViolation of Secure Design Principles
   6 votes
9. HTTPS proxy connection reuse lets one easy handle inherit another handle's mTLS-authenticated proxy sessionDuplicateExposure of Data Element to Wrong Session · medium
   6 votes
10. OpenSSL provider OSSL_LIB_CTX used after free via the connection shutdown list (CVE-2026-80229 fix incomplete)DuplicateUse After Free · low
    3 votes
11. 20: HTAB before `Secure` attribute silently drops the Secure cookie flagDuplicateMisconfiguration
    1 votes
12. 14: HSTS cache import silently drops a longer-lived child beneath an includeSubDomains parentDuplicateCleartext Transmission of Sensitive Information