When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final…

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an…

Resource leakage when decoding certificates and keys

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes

The c_rehash script allows command injection

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly

OCSP_basic_verify may incorrectly verify the response signing certificate

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server…