HexBrain

curl · Report #3791168

curl-ipv4-percent-normalization-SSRF

Informativestatus
mediumseverity
13upvotes
10 Jun 2026disclosed

How it was found

Summary:

[six or fewer sentences describing the issue in your own human voice and optionally a short proof-of-concept script]

Affected version

[Which curl/libcurl version are you using to reproduce? On which platform? curl -V typically generates good output to include]

Steps To Reproduce:

[add details for how we can reproduce the issue]

Again: there is no bug-bounty for curl. We do not offer any rewards, only proper credits.

Impact

Summary:

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original