Browse / curl

curl

See its reports on the map

What gets reported to curl

• Memory Corruption163
• Information Disclosure95
• Cryptography74
• Injection and Smuggling66
• Authentication54
• Business Logic52

Most upvoted reports

AllValidInformativeN/ADuplicate

1. HTTP/3 Stream Dependency Cycle ExploitN/AImproper Input Validation · high
   60 votes
2. Buffer overflow in strcpyN/ABuffer Underflow · critical
   53 votes
3. Hackers Attack Curl Vulnerability Accessing Sensitive InformationN/AInformation Disclosure · medium
   48 votes
4. Integer Underflow in src/var.cN/AInteger Underflow · medium
   46 votes
5. Buffer Overflow Vulnerability in strcpy() Leading to Remote Code ExecutionN/AClassic Buffer Overflow · critical
   45 votes
6. Security check upN/AAllocation of Resources Without Limits or Throttling · low
   44 votes
7. wcurl Argument Injection via Unquoted VariableN/ACommand Injection - Generic · medium
   43 votes
8. curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download writeN/ATime-of-check Time-of-use (TOCTOU) Race Condition · medium
   42 votes
9. CRLF Injection in `--proxy-header` allows extra HTTP headers (CWE-93)N/ACRLF Injection
   42 votes
10. Windows SSPI connection-pool probe can reuse a connection under the wrong userN/AAuthentication Bypass by Spoofing · medium
    39 votes
11. HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiBN/AAllocation of Resources Without Limits or Throttling
    39 votes
12. Buffer Overflow Risk in Curl_inet_ntop and inet_ntop4N/AClassic Buffer Overflow · high
    39 votes
13. Buffer Overflow Vulnerability in WebSocket HandlingN/AHeap Overflow · high
    38 votes
14. curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session HijackingN/AMan-in-the-Middle
    37 votes
15. Integer Overflow in curl_multi_get_handles() Leading to Heap Buffer OverflowN/AClassic Buffer Overflow · medium
    36 votes
16. Unsanitized IPFS CID Allows SSRF Against Configured GatewayN/AServer-Side Request Forgery (SSRF) · medium
    34 votes
17. on the implications of permitting procedural cullingN/AUse of Insufficiently Random Values · low
    33 votes
18. Exposed .git/config File Leading to Potential Sensitive Information DisclosureN/AInformation Disclosure · low
    32 votes
19. Missing Security HeadersN/AMisconfiguration · medium
    32 votes
20. WebSocket Fragmentation DoS on Curl ClientN/AUncontrolled Resource Consumption · high
    32 votes
21. SSL options ISSUERCERT, EC_CURVES and CRLFILE silently ignored by non-OpenSSL backendsN/AMissing Required Cryptographic Step · medium
    31 votes
22. Arbitrary File Read via file:// Protocol in cURLN/APath Traversal · critical
    31 votes
23. curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer HijackN/ATime-of-check Time-of-use (TOCTOU) Race Condition · critical
    30 votes
24. Vulnerability Report: Buffer Overflow in Path SanitizationN/AMemory Corruption - Generic · critical
    30 votes
25. SMB READ_ANDX DataOffset not validatedN/Ahigh
    30 votes
26. Cross‑origin cookies leak and injection risk when using a custom Host headerN/AInsufficiently Protected Credentials
    30 votes
27. libcurl: Host-Only Cookies Leak to Alternate IPv4 FormsN/AMisconfiguration
    30 votes
28. Use-After-Free in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurlN/AUse After Free · high
    30 votes
29. bypass of this Fixed #2437131 [ Inadequate Protocol Restriction Enforcement in curl ]N/ACleartext Transmission of Sensitive Information · low
    30 votes
30. cookie is sent on redirectN/AInsufficiently Protected Credentials · medium
    30 votes
31. Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` headeN/AInformation Disclosure · high
    29 votes
32. Internal application wrapper or script using curlN/ACode Injection · critical
    29 votes
33. ("possible") UAFN/AMemory Corruption - Generic
    29 votes
34. Cookie Max-Age Integer Overflow VulnerabilityN/AInteger Overflow · critical
    28 votes
35. Out-of-bounds read in HTTP method handling causes undefined behavior and potential crash This is sharp, Gaurav. We’ve got a real memory-safety bug insN/ABuffer Over-read · high
    28 votes
36. Timing Attack Vulnerability in curl Digest Authentication via Non-Constant-Time String ComparisonN/AInformation Exposure Through Timing Discrepancy · medium
    28 votes
37. curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/TorN/AInformation Disclosure
    28 votes
38. Integer Overflow in schannel.c TLS Data TransmissionN/AInteger Overflow · medium
    28 votes
39. URL API: triple-slash parses path segment as hostnameN/AUse of Incorrectly-Resolved Name or Reference · medium
    27 votes
40. AWS SigV4 Signature Disclosure via Verbose Logging in libcurlN/AInformation Disclosure
    27 votes
41. SMTP Command Injection Vulnerabilities in curlN/ACommand Injection - Generic
    27 votes
42. Stack use-after-scope in HTTP/3 POST request processing via CURLOPT_POSTFIELDSN/AUse After Free · high
    27 votes
43. Double Free Vulnerability in `libcurl` Cookie Management (`cookie.c`)N/ADouble Free
    27 votes
44. HackerOneN/AArray Index Underflow
    26 votes
45. Security Analysis Report: CURL Integer Overflow VulnerabilityN/AInteger Overflow
    26 votes
46. Exposure of Private RSA Private Key in curl GitHub RepositoryN/AInsecure Storage of Sensitive Information
    26 votes
47. Default Minimum TLS Version Set to TLS v1.0 (Cryptographic Weakness)N/AUse of a Broken or Risky Cryptographic Algorithm · medium
    26 votes
48. SSTI leads to Command injectionN/ACommand Injection - Generic
    25 votes
49. Directory Traversal Vulnerability in cURL via Content-Disposition Header ProcessingN/APath Traversal · medium
    25 votes
50. curl GnuTLS backend accepts a clientAuth-only certificate for HTTPS server authenticationN/AImproper Certificate Validation · medium
    24 votes
51. Vulnerability Report: Public Exposure of Security Audit FileN/AInformation Disclosure · medium
    24 votes
52. libcurl cache updates follow symlinks and truncate their targetsN/ATime-of-check Time-of-use (TOCTOU) Race Condition · low
    23 votes
53. GnuTLS OCSP stapling accepts unrelated SingleResponse (no cert-ID binding)N/AImproper Certificate Validation · high
    23 votes
54. wcurl treats some URL operands after -- as curl optionsN/AImproper Neutralization of Value Delimiters · medium
    23 votes
55. Argument Injection via curl Short-Flag GroupingN/ACommand Injection - Generic · critical
    23 votes
56. libcurl: Integer truncation in curl_easy_ssls_import() causes TLS sessions to never expireN/AImproper Authentication - Generic · medium
    23 votes
57. Use-After-Free race condition in url_move_hostname() via shared connection poolN/AUse After Free · medium
    23 votes
58. Bearer Token Leaked to Attacker via .netrc Despite CVE-2026-3783 FixN/AImproper Authentication - Generic
    23 votes
59. TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation BypassN/ATime-of-check Time-of-use (TOCTOU) Race Condition · high
    23 votes
60. Curl parse_connect_to_string Heap-Overread Leading to Denial of Service via CURLOPT_CONNECT_TON/ABuffer Over-read · medium
    23 votes
61. HTTP Request Smuggling Vulnerability Analysis - cURL Security ReportN/AHTTP Request Smuggling · medium
    23 votes
62. Exploitable Format String Vulnerability in curl_mfprintf FunctionN/AUse of Externally-Controlled Format String · high
    23 votes
63. Missing applicability validation allows non-applicable HTTPS RR to reach ECH processingN/ABusiness Logic Errors · medium
    22 votes
64. Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfersN/AIncorrect Authorization
    22 votes
65. Able to bypass HSTS using trailing dotN/AMissing Required Cryptographic Step · medium
    22 votes
66. Hi HackerN/ABusiness Logic Errors
    22 votes
67. Inconsistent URL Parsing in curl Leading to Potential SSRF and Access Control BypassN/AImproper Input Validation · low
    22 votes
68. Incomplete Suppression of Transfer-Encoding: chunked Header in HTTP/2 After Redirect From HTTP/1.1N/AHTTP Request Smuggling · low
    21 votes
69. Potential Resource Leak in tool_parsecfg.c at line 279 during fileerrorN/AUncontrolled Resource Consumption · low
    21 votes
70. Cookie Replacement Use-After-Free VulnerabilityN/AUse After Free
    21 votes
71. Incorrect Parsing of IPv6 Zone ID in curlN/AAuthentication Bypass by Primary Weakness · high
    21 votes
72. CRLF injection in libcurl's SMTP client via --mail-from and --mail-rcpt allows SMTP command smugglingN/ACRLF Injection · medium
    21 votes
73. HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb TunnelingN/AImproper Access Control - Generic · high
    21 votes
74. Use of a Broken or Risky Cryptographic Algorithm (CWE-327) in libcurlN/AUse of a Broken or Risky Cryptographic Algorithm
    21 votes
75. Buffer overflow and affected url:-https://github.com/curl/curl/blob/master/docs/examples/hsts-preload.cN/AClassic Buffer Overflow · critical
    21 votes
76. CRLF Injection via Custom HTTP HeadersN/ACRLF Injection
    20 votes
77. HTTP/2 and HTTP/3 Header Injection in curlN/AHTTP Response Splitting
    20 votes
78. Protocol Smuggling / CRLF Injection via Gopher Protocol allows Arbitrary Command InjectionN/ACRLF Injection · high
    20 votes
79. Title: Use-After-Free in cURL Test Suite via Improper Cleanup of Global HandleN/AUse After Free · high
    20 votes
80. GnuTLS CURLINFO_TLS_SESSION / CURLINFO_TLS_SSL_PTR type confusionN/AType Confusion
    20 votes
81. Uncontrolled File Write/Arbitrary File Creation N/ACode Injection · high
    20 votes
82. Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.N/AType Confusion · critical
    20 votes
83. Cookie exposure due to unexpected file permission changeN/AFile and Directory Information Exposure · medium
    20 votes
84. SMTP CRLF injection in custom SMTP recipient operand allows additional SMTP commands after authenticationN/ACRLF Injection · medium
    19 votes
85. File URL UNC Path Access (Windows SSRF)N/AServer-Side Request Forgery (SSRF) · high
    19 votes
86. Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure)N/AInformation Disclosure · medium
    19 votes
87. ## Title Heap Use-After-Free Vulnerability in `curl` Leading to Potential Code ExecutionN/AUse After Free · medium
    19 votes
88. Account/Repository Takeover via Abandoned GitHub Username in curl's href_extractor.cN/ALLM05: Supply Chain Vulnerabilities · medium
    19 votes
89. Insecure WebSocket Usage in curl Documentation and Examples (CWE-319: Cleartext Transmission of Sensitive Information)N/ACleartext Transmission of Sensitive Information · high
    19 votes
90. Heap Buffer Overflow in Curl_memdup0() via CURLOPT_COPYPOSTFIELDS/CURLOPT_POSTFIELDSIZE MismatchN/ABuffer Over-read · high
    19 votes
91. mbedTLS / wolfSSL / rustls backends silently skip hostname verification when CURLOPT_SSL_VERIFYPEER=0N/AImproper Validation of Certificate with Host Mismatch · medium
    18 votes
92. libcurl: HTTP/1.x bare LF byte in response header value enables cookie jar pollution and POST body/credential exfiltration via redirect — RC=0, curl 8N/AHTTP Response Splitting · high
    18 votes
93. CURLOPT_UNRESTRICTED_AUTH Dangerous Default Documentation GapN/AInformation Disclosure · low
    18 votes
94. Path Traversal in curl file:// Protocol Handler Allows Unauthorized File AccessN/APath Traversal · high
    18 votes
95. Proxy-Authorization header is leaked to origin server after redirect from proxied to direct connectionN/AInformation Exposure Through Sent Data · high
    18 votes
96. Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path NormalizationN/APath Traversal · high
    18 votes
97. Integer Overflow to Heap Overflow in DoH Response HandlingN/AHeap Overflow
    18 votes
98. SMTP Command Injection Vulnerability in libcurl 8.16.0 via RFC 3461 SuffixN/ACRLF Injection
    18 votes
99. Stack Buffer Overflow in cURL Cookie Parsing Leads to RCEN/AStack Overflow · high
    18 votes
100. Multiple Unsafe strcpy() Function Calls Leading to Potential Buffer Overflow Vulnerabilities in cURL 8.16.1-DEVN/AClassic Buffer Overflow · high
     18 votes