CURLOPT_PROXY_CRLFILE / CURLOPT_PROXY_ISSUERCERT / CURLOPT_PROXY_ISSUERCERT_BLOB silently ignored on backends that don't support them

How it was found

(From the Mythos report 2026-05-06)

F1. CURLOPT_PROXY_CRLFILE / CURLOPT_PROXY_ISSUERCERT / CURLOPT_PROXY_ISSUERCERT_BLOB silently ignored on backends that don't support them — severity Low

https://github.com/curl/curl/blob/455bebc2c7/lib/setopt.c#L1786-L1797 https://github.com/curl/curl/blob/455bebc2c7/lib/setopt.c#L2837-L2841 https://github.com/curl/curl/blob/455bebc2c7/lib/setopt.c#L1890-L1897 (non-proxy CRLFILE, correctly gated) https://github.com/curl/curl/blob/455bebc2c7/lib/setopt.c#L2247-L2254 (non-proxy ISSUERCERT, correctly gated)

CURLOPT_CRLFILE checks Curl_ssl_supports(data, SSLSUPP_CRLFILE) and returns CURLE_NOT_BUILT_IN on unsupported backends. CURLOPT_PROXY_CRLFILE does not - it stores the string and returns CURLE_OK regardless. Same for ISSUERCERT and ISSUERCERT_BLOB. Affected backends all declare SSLSUPP_HTTPS_PROXY (wolfssl.c:2318, mbedtls.c:1597, schannel.c:2855, rustls.c:1424) so they do handle HTTPS-proxy connections, but they never read the proxy CRL/issuer settings.

Same bug class as CVE-2025-5025 (no QUIC pinning with wolfSSL), CVE-2025-13034 (no QUIC pinning with GnuTLS), CVE-2024-2466 - all rated Low.

For completeness: OpenSSL's proxy leg does consume these via Curl_ssl_cf_get_primary_config(cf) → conn_config->issuercert_blob at openssl.c:4507 and ssl_config->primary.CRLfile at openssl.c:3100, so the option is functional on at least one backend; the setopt-acceptance asymmetry is the bug.

Impact

Impact: an application sets CURLOPT_PROXY_CRLFILE with wolfSSL or Schannel, gets CURLE_OK, and assumes revoked proxy certificates will be rejected. They are not. CURLOPT_PROXY_ISSUERCERT is silently ignored on wolfSSL/mbedTLS/Schannel/rustls. CURLOPT_PROXY_ISSUERCERT_BLOB on everything except OpenSSL. verifypeer/verifyhost still run; only the additional restriction is dropped.