secure cookie attribute bypass with tab

native CA store conn reuse

OpenSSL pinning bypass

OpenSSL provider use-after-free

sending old referer

exposing HTTP/3 early data

incomplete mTLS config matching in conn reuse

proto-default skips SSH verification

WS Auto-PONG memory exhaustion

QUIC zero-length UDP datagrams busy-loop

stale custom cookie host causes cookie leak

wrong reuse of SMB connection

use after free in SMB connection reuse

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text…

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API

A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious…

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it…

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used…

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id…

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line…

libcurl-using applications can ask for a specific client certificate to be used in a transfer

curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s)

curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server

A flaw was found in curl before version 7.51

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer…

A flaw was found in curl before version 7.51.0

The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into…

A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service

OpenLDAP SASL authentication bypass

SSH improper host validation

UAF after pause in socket callback

gzip integer overflow

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to…

eventfd double close

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`

wrong reuse for different services

wrong reuse of HTTP Negotiate connection

wrong proxy connection reuse with credentials

bad reuse of HTTP Negotiate connection

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended

OCSP stapling bypass with GnuTLS

TLS certificate check bypass with mbedTLS

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response…