proxy credentials leak over redirect-to proxy

connection reuse ignores TLS requirement

No QUIC certificate pinning with GnuTLS

cross-proxy Digest auth state leak

OCSP stapling bypass with Apple SecTrust

netrc credential leak with reused proxy connection

token leak with redirect and netrc

libssh global known_hosts override

OpenSSL partial chain store policy bypass

bearer token leak on cross-protocol redirect

predictable WebSocket mask

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should…

No QUIC certificate pinning with wolfSSL

wcurl path traversal with percent-encoded slashes

missing SFTP host verification with wolfSSH

macidn punycode buffer overread

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1

Usage of disabled protocol

netrc and default credential leak

netrc and redirect credential leak

libssh key passphrase bypass without agent set

local interface connection reuse mixup

info leak uploading over WebSockets with GnuTLS

password leak in CURLINFO_EFFECTIVE_URL

Authorization: Negotiate sent to foreign origin

curl_mime_free stack overflow by recursion

-J no-clobber guarantee bypassed with 103 early hints

TFTP direction confusion

FTP wildcard write callback mixup

never-ending loop via server response omission

server-set cookie aborts cookie jar load

wolfSSL public-key pinning bypass

knownhost callback mismatches key as missing

HSTS response erases persisted entries

IMAP APPEND plus CRLF conversion command injection

HSTS cache import drops longer-lived child

cross-origin reuse of a Negotiate connection

auto client cert connection reuse mixup

leaking host credentials to HTTP proxy

Negotiate credentials sent to redirected origin

server-set cookie erases cookie jar

FTP connection reuse inherits client-certificate

redirect to SFTP or SCP bypasses host verification

stale SigV4 headers sent unintended

curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection…

Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary…

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP…

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM…