Negotiate ambient user conn reuse

stale proxy password leak

SASL double-free

cross-origin Digest auth state leak

HTTP/2 stream-dependency tree UAF

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake

HTTP/2 server push UAF

env-set cross-proxy Digest auth state leak

password leak with netrc and user in URL

trailing dot domain super cookie

Native CA trust persist

HTTP/2 push headers memory-leak

domain-scoped PSL domain cookie

HTTP/2 upload Use-After-Free

wrong STARTTLS connection reuse

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1

wolfSSL CA-cache hit overrides callback

secure cookie attribute bypass with tab

native CA store conn reuse

OpenSSL pinning bypass

OpenSSL provider use-after-free

sending old referer

exposing HTTP/3 early data

incomplete mTLS config matching in conn reuse

proto-default skips SSH verification

WS Auto-PONG memory exhaustion

QUIC zero-length UDP datagrams busy-loop

stale custom cookie host causes cookie leak

wrong reuse of SMB connection

OpenLDAP SASL authentication bypass

SSH improper host validation

UAF after pause in socket callback

gzip integer overflow

eventfd double close

wrong reuse for different services

wrong reuse of HTTP Negotiate connection

OCSP stapling bypass with GnuTLS

ASN.1 date parser overread

TLS certificate check bypass with mbedTLS

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible

QUIC certificate check bypass with wolfSSL

proxy credentials leak over redirect-to proxy

connection reuse ignores TLS requirement

cross-proxy Digest auth state leak

OCSP stapling bypass with Apple SecTrust

netrc credential leak with reused proxy connection

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should…

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1

Usage of disabled protocol