wrong reuse for different services

wrong reuse of HTTP Negotiate connection

wrong proxy connection reuse with credentials

bad reuse of HTTP Negotiate connection

QUIC certificate check skip with wolfSSL

HSTS subdomain overwrites parent cache entry

OCSP stapling bypass with GnuTLS

TLS certificate check bypass with mbedTLS

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response…

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested…

curl can be told to parse a `.netrc` file for credentials

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port…

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out…

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for…

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers

broken TLS options for threaded LDAPS

QUIC certificate check bypass with wolfSSL

proxy credentials leak over redirect-to proxy

connection reuse ignores TLS requirement

No QUIC certificate pinning with GnuTLS

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS…

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time

A use after free vulnerability exists in curl <7.87.0

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple…

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows…

cross-proxy Digest auth state leak

OCSP stapling bypass with Apple SecTrust

netrc credential leak with reused proxy connection

token leak with redirect and netrc

libssh global known_hosts override

OpenSSL partial chain store policy bypass

bearer token leak on cross-protocol redirect

predictable WebSocket mask

curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should…

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then…

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the…

In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use…

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or…

cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name

No QUIC certificate pinning with wolfSSL

missing SFTP host verification with wolfSSH

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL