netrc and default credential leak

netrc and redirect credential leak

local interface connection reuse mixup

info leak uploading over WebSockets with GnuTLS

password leak in CURLINFO_EFFECTIVE_URL

Authorization: Negotiate sent to foreign origin

curl_mime_free stack overflow by recursion

-J no-clobber guarantee bypassed with 103 early hints

TFTP direction confusion

FTP wildcard write callback mixup

never-ending loop via server response omission

server-set cookie aborts cookie jar load

wolfSSL public-key pinning bypass

knownhost callback mismatches key as missing

HSTS response erases persisted entries

IMAP APPEND plus CRLF conversion command injection

HSTS cache import drops longer-lived child

cross-origin reuse of a Negotiate connection

auto client cert connection reuse mixup

leaking host credentials to HTTP proxy

Negotiate credentials sent to redirected origin

server-set cookie erases cookie jar

FTP connection reuse inherits client-certificate

redirect to SFTP or SCP bypasses host verification

stale SigV4 headers sent unintended

curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection…

Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary…

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP…

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM…