A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested…

curl can be told to parse a `.netrc` file for credentials

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port…

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out…

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for…

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers

broken TLS options for threaded LDAPS

QUIC certificate check bypass with wolfSSL

proxy credentials leak over redirect-to proxy

connection reuse ignores TLS requirement

No QUIC certificate pinning with GnuTLS

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS…

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time

A use after free vulnerability exists in curl <7.87.0

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple…

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows…

cross-proxy Digest auth state leak

OCSP stapling bypass with Apple SecTrust

netrc credential leak with reused proxy connection

token leak with redirect and netrc

libssh global known_hosts override

OpenSSL partial chain store policy bypass

bearer token leak on cross-protocol redirect

predictable WebSocket mask

curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should…

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then…

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the…

In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use…

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or…

cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name

libcurl supports *pinning* of the server certificate public key for HTTPS transfers

missing SFTP host verification with wolfSSH

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for…

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server…

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract…

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1

Usage of disabled protocol

netrc and default credential leak

netrc and redirect credential leak

Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay

libssh key passphrase bypass without agent set

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content…