Browse / curl

curl

See its reports on the map

What gets reported to curl

• Memory Corruption163
• Information Disclosure95
• Cryptography74
• Injection and Smuggling66
• Authentication54
• Business Logic52

Most upvoted reports

AllValidInformativeN/ADuplicate

1. [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped FilenamesInformativePath Traversal · high
   54 votes
2. MQTT Protocol Packet Injection via Unchecked CONNACK Remaining LengthInformativeCode Injection · low
   45 votes
3. `Curl_socketpair()` fallback vulnerable to man-in-the-middle attackInformativeMan-in-the-Middle
   45 votes
4. mbedTLS private-key blob null-termination asymmetry in lib/vtls/mbedtls.c (mbed_load_privkey)InformativeImproper Null Termination
   42 votes
5. Credential leak on redirect due to improper state clearing when parsing macdef in netrc.cInformativeInformation Exposure Through Sent Data · low
   41 votes
6. urlapi: off-by-one in custom scheme validation skips last characterInformativeOff-by-one Error · high
   38 votes
7. Bypassing Strict SSH Server Verification via Connection Pool Reuse in libcurlInformativeImproper Access Control - Generic
   37 votes
8. MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstateInformativeImproper Input Validation · medium
   36 votes
9. Sensitive information disclosure with malicious netrc fileInformativeLLM06: Sensitive Information Disclosure · medium
   36 votes
10. Windows filename sanitizer misses Unicode COM/LPT reserved device namesInformative
    35 votes
11. Credentials forwarded to HTTP after HTTPS→HTTP same-port redirect — url_set_data_creds uses scheme-blind comparatorInformative
    35 votes
12. Domainless COOKIEFILE cookie leaks to unrelated IP-literal hostsInformativeInformation Exposure Through Sent Data
    31 votes
13. MQTT CONNACK Packet Type Bypass leads to RCE via Malicious BrokerInformativeASI05: Unexpected Code Execution (RCE) · critical
    31 votes
14. SSH/SFTP connection reuse can bypass SSH key identity after ssh_config_matches removalInformativeAuthentication Bypass by Primary Weakness · high
    30 votes
15. Schannel custom-CA path skips Extended Key Usage enforcementInformativeBusiness Logic Errors
    30 votes
16. lib/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a)InformativeAuthentication Bypass by Primary Weakness · medium
    30 votes
17. HTTP/1.1 Response Desynchronization via conflicting CL/TE headers in Proxy CONNECTInformativeHTTP Request Smuggling · low
    30 votes
18. Apple SecTrust legacy path accepts untrusted certificates on pre-10.14 macOS/iOS when built with USE_APPLE_SECTRUSTInformativeImproper Certificate Validation · high
    30 votes
19. OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients)InformativeUncontrolled Resource Consumption · low
    30 votes
20. Use After Free (that leads to arbitrary Write for some versions) InformativeUse After Free
    30 votes
21. libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realmsInformativeInformation Disclosure · medium
    29 votes
22. Heap‑based buffer overflow in curl -K <config_file> allows arbitrary write .InformativeHeap Overflow · high
    29 votes
23. Curl_compareheader() fails to match multi-value HTTP headersInformativeExpected Behavior Violation · medium
    28 votes
24. RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload)InformativeImproper Check or Handling of Exceptional Conditions
    28 votes
25. Memory LeakInformativeMemory Corruption - Generic
    28 votes
26. Heap-OOB read in urlapi `redirect_url()` via `CURLU_GUESS_SCHEME` + `CURLU_NO_GUESS_SCHEME` flowInformativeBuffer Over-read
    27 votes
27. HTTP/1.1 response framing violation and unsafe connection reuse when transfer decoding is disabledInformativeHTTP Request Smuggling · medium
    26 votes
28. HackerOne Vulnerability Report: libcurl SSL/TLS Identity Leakage via Insecure Connection ReuseInformativeAuthentication Bypass by Primary Weakness
    26 votes
29. HTTP/2 server push accepts a non-authoritative :scheme=https over cleartext h2c, enabling HTTPS cache-key poisoningInformativeImproper Input Validation · high
    26 votes
30. Unescaped username in SASL DIGEST-MD5 response allows injectionInformativeImproper Neutralization of Escape, Meta, or Control Sequences · low
    26 votes
31. Arbitrary free in curl's config file parsing.InformativeBusiness Logic Errors · low
    26 votes
32. Use after free (read) in curl_multi_perform with DoH and Proxy options, and resolve timeoutsInformativeUse After Free
    26 votes
33. NULL dereference when encoding DN of x509 certificateInformativeNULL Pointer Dereference · low
    26 votes
34. curl 8.23.0 keeps sending requests to an HTTP/3 backend after Alt-Svc: clearInformativeImproper Access Control - Generic · high
    25 votes
35. HSTS accepted from HTTP origin behind HTTPS proxyInformativeAcceptance of Extraneous Untrusted Data With Trusted Data
    25 votes
36. NULL Pointer Dereference (DoS) in libcurl SFTP QUOTE command parsing due to missing return statementInformativeNULL Pointer Dereference · medium
    25 votes
37. HTTP/3 Protocol Smuggling and Header Injection via CRLF in QPACK value conversionInformativeCRLF Injection · critical
    24 votes
38. Heap-buffer-overflow (Out-of-Bounds Read) in DoH hostname encodingInformativeOut-of-bounds Read
    24 votes
39. curl ASSERTs when accessing an LDAP URLInformativeBusiness Logic Errors
    24 votes
40. 55: Heap-buffer-overflow read in `curl_formadd_ccsid()` with binary form dataInformativeOut-of-bounds Read
    23 votes
41. Data race in Curl_dnscache_add_negative() corrupts shared DNS cache — heap corruption and double-free when using CURLOPT_SHARE with CURL_LOCK_DATA_DNSInformativeConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · medium
    23 votes
42. [SFTP] TOCTOU Race Condition in Upload Resume Logic Leads to Arbitrary File AppendInformativeTime-of-check Time-of-use (TOCTOU) Race Condition · medium
    23 votes
43. IMAP connection reuse runs requests in the wrong case-sensitive mailboxInformativeImproper Handling of Case Sensitivity · low
    22 votes
44. heap-use-after-free in state.referer when CURLOPT_REFERER replaced or cleared after performInformativeUse After Free · low
    22 votes
45. libcurl stale CURLOPT_AUTOREFERER leaks a previous request URL to a different origin on a reused easy handleInformativeInformation Exposure Through Sent Data · low
    22 votes
46. Unbounded memory consumption via compressed HTTP responses (gzip/brotli/zstd)InformativeUncontrolled Resource Consumption · medium
    21 votes
47. OpenSSL HTTP/3 bogus CURLINFO_TLS_SSL_PTRInformativeUse After Free
    21 votes
48. Cookie jar load skips public suffix check on PSL buildsInformativeInformation Exposure Through Sent Data · medium
    20 votes
49. Functional Regression in Digest Authentication: Failure to handle optional spaces and escaped quotesInformativeImproper Input Validation · low
    20 votes
50. Memory leak of ftp (with proxy reuse)InformativeInformation Disclosure
    20 votes
51. HTTP/2 PUSH_PROMISE DoSInformativeUncontrolled Resource Consumption · medium
    20 votes
52. 12: SASL DIGEST-MD5 does not validate the server's `rspauth` proofInformativeMissing Critical Step in Authentication
    19 votes
53. UAF read in mev_pollset_diff() trace path after curl_easy_pause() in socket callbackInformativeUse After Free · low
    19 votes
54. Use after free in hyperfifo exampleInformativeUse After Free
    19 votes
55. PROTOCOL-LEVEL: Persistent UDP Amplification and Cache Poisoning via Alt-Svc Logic FlawInformativeBusiness Logic Errors · high
    19 votes
56. When curl uses Schannel as TLS backend, it fails to enforce TLS 1.3 cipher suite selections correctlyInformativeBusiness Logic Errors · medium
    19 votes
57. libcurl LDAP LDIF: entry DN and attribute names written without RFC 2849 base64 encoding, allowing server line injectionInformativeCRLF Injection · low
    18 votes
58. 27: IMAP custom FETCH listing classification skips literal boundaries, enabling response desynchronizationInformative
    18 votes
59. Duplicate chunked Transfer-Encoding lets a malicious origin smuggle a response across reused HTTP proxy connectionsInformativeHTTP Request Smuggling · medium
    18 votes
60. libcurl 8.20.0 incomplete fix for CVE-2026-7168: changing only CURLOPT_PROXYPORT leaks stale Proxy Digest auth to a different proxyInformativeUncontrolled Resource Consumption · medium
    18 votes
61. Cookie attribute TAB injection regression in Set-Cookie parsingInformativeImproper Input Validation · low
    18 votes
62. LM Challenge-Response Hash Always Sent in SMB AuthenticationInformativeReversible One-Way Hash · medium
    18 votes
63. curl built with GnuTLS backend defaults to weak crypto parametersInformativeInadequate Encryption Strength
    18 votes
64. Cookie attribute truncation in curl drops Secure/HttpOnly protectionsInformativeInformation Exposure Through Sent Data · low
    17 votes
65. Use-after-free of the internal multi->admin easy handle via the documented CURLMOPT_NOTIFYFUNCTION callbackInformativeUse After Free · medium
    17 votes
66. 22: FTP wildcard matching decodes server-provided filenames, enabling directory traversalInformativePath Traversal
    17 votes
67. SSL session-cache peer key omits signature_algorithms: strict-sigalg handle silently resumes a permissive sibling's sessionInformativeImproper Certificate Validation
    17 votes
68. Digest Auth State Leak on Cross-Origin Redirect via Netrc - Username and Password Hash Sent to Wrong HostInformativeInsufficiently Protected Credentials · medium
    17 votes
69. Certificate Hostname Validation Bypass via Leading Dot in HostnameInformativeImproper Certificate Validation · medium
    17 votes
70. Race condition on global `gss_context` during SOCKS5 GSS-API negotiation in libcurlInformativeConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · medium
    17 votes
71. int overflow in krb5_read_data() leads to (possible) massive `recv()` writeInformativeInteger Overflow · low
    17 votes
72. libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP requestInformativeImproper Input Validation · low
    16 votes
73. HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)InformativeHTTP Request Smuggling · medium
    16 votes
74. 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interfaceInformativeInformation Disclosure
    16 votes
75. TLS conn reuse and session cache ignore fsslctx callback and ssl_config_data flags ( incomplete fix variant of 7541ae569 )InformativeInsufficiently Protected Credentials · high
    16 votes
76. Telnet Suboption Buffer Pointer Underflow in lib/telnet.c leads to Out-of-Bounds ReadInformativeBuffer Under-read · low
    16 votes
77. Use-after-free when POST body buffer is freed before transferInformativeUse After Free · medium
    16 votes
78. TLS session cache case-folds CA paths and bypasses the active trust profileInformativeImproper Certificate Validation · medium
    15 votes
79. CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple buildsInformativeBusiness Logic Errors
    15 votes
80. no_proxy IDN mismatch: Unicode hostnames bypass proxy exclusion listInformativeImproper Access Control - Generic
    15 votes
81. Improper enforcement of CURLOPT_SOCKS5_AUTH due to missing reuse key validation in libcurlInformativeImproper Authorization · low
    15 votes
82. HTTP/2 PUSH_PROMISE header loss on OOM bypasses scheme validation (regression of 2e8c922a89)InformativeImproper Handling of Insufficient Permissions or Privileges · medium
    15 votes
83. Use after free (or assert triggered) with failed allocations in opensslInformativeUse After Free
    15 votes
84. Socket API drops expired timeouts for transfers queued behind a connection limitInformative
    14 votes
85. libcurl Digest/NTLM authentication ignores an explicit Authorization headerInformativeIncorrect Authorization · medium
    14 votes
86. OpenSSL TLS 1.2 session resumption accepts expired server certificates in libcurlInformativeImproper Validation of Certificate Expiration
    14 votes
87. CURLOPT_PROXY_CRLFILE / CURLOPT_PROXY_ISSUERCERT / CURLOPT_PROXY_ISSUERCERT_BLOB silently ignored on backends that don't support themInformativeImproper Check for Certificate Revocation · low
    14 votes
88. IMAP Protocol Desynchronization and Response Smuggling via Naive Literal ParsingInformativeImproper Input Validation · low
    14 votes
89. MQTT Protocol Violation & Integer Overflow in libcurlInformativeInteger Overflow · high
    14 votes
90. curl doesn't hide credentials in /proc/XXX/cmdline provided via CLI argumentsInformativeCleartext Transmission of Sensitive Information · medium
    14 votes
91. Elevation of Privileges (EoP) vulnerabilities related to the some easy_options on WindowsInformativePrivilege Escalation · high
    14 votes
92. Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requestsInformativeInformation Exposure Through Sent Data · low
    13 votes
93. curl tool: --hsts is ignored for a schemeless URL starting with a slash under --proto-default httpInformativeCleartext Transmission of Sensitive Information · low
    13 votes
94. TELNET control and environment data bypass HTTPS-proxy TLSInformativeImproper Access Control - Generic
    13 votes
95. 50: CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usableInformativeServer-Side Request Forgery (SSRF)
    13 votes
96. Unbound cross-peer HTTP Digest challenge stateInformativemedium
    13 votes
97. Use-after-free in `mev_forget_socket` when `curl_easy_pause()` is called from a `CURL_POLL_REMOVE` socket callback (incomplete fix of CVE-2026-9080)InformativeUse After Free · low
    13 votes
98. curl-ipv4-percent-normalization-SSRFInformativeServer-Side Request Forgery (SSRF) · medium
    13 votes
99. cookie: case-insensitive path comparison in replace_existing() allows cookie eviction across distinct pathsInformativeBusiness Logic Errors
    13 votes
100. libcurl reuses a learned RTSP Session header across different hosts on the same easy handle, enabling cross-host session leak and replayInformativeExposure of Data Element to Wrong Session · medium
     13 votes