curl.

local interface connection reuse mixup

• curl
• CWE-488

info leak uploading over WebSockets with GnuTLS

• curl
• CWE-126

password leak in CURLINFO_EFFECTIVE_URL

• curl
• Hard-coded credentials

Authorization: Negotiate sent to foreign origin

• curl
• Information disclosure

curl_mime_free stack overflow by recursion

• curl
• Denial of service

-J no-clobber guarantee bypassed with 103 early hints

• curl
• Path traversal

TFTP direction confusion

• curl
• Information disclosure

FTP wildcard write callback mixup

• curl
• Memory corruption

never-ending loop via server response omission

• curl
• Denial of service

server-set cookie aborts cookie jar load

• curl
• CWE-1284

wolfSSL public-key pinning bypass

• curl
• Weak cryptography or TLS

knownhost callback mismatches key as missing

• curl
• Weak cryptography or TLS

HSTS response erases persisted entries

• curl
• Information disclosure

IMAP APPEND plus CRLF conversion command injection

• curl
• CWE-130

HSTS cache import drops longer-lived child

• curl
• Information disclosure

cross-origin reuse of a Negotiate connection

• curl
• Information disclosure

auto client cert connection reuse mixup

• curl
• Information disclosure

leaking host credentials to HTTP proxy

• curl
• Information disclosure

Negotiate credentials sent to redirected origin

• curl
• Information disclosure

server-set cookie erases cookie jar

• curl
• CWE-754

FTP connection reuse inherits client-certificate

• curl
• CWE-488

redirect to SFTP or SCP bypasses host verification

• curl
• Weak cryptography or TLS

stale SigV4 headers sent unintended

• curl
• Information disclosure

HTTP/2 upload Use-After-Free

• curl
• Memory corruption

domain-scoped PSL domain cookie

• curl
• Information disclosure

wolfSSL CA-cache hit overrides callback

• curl
• Weak cryptography or TLS

secure cookie attribute bypass with tab

• curl
• Information disclosure

native CA store conn reuse

• curl
• CWE-488

OpenSSL pinning bypass

• curl
• Weak cryptography or TLS

OpenSSL provider use-after-free

• curl
• Memory corruption

Negotiate ambient user conn reuse

• curl
• CWE-488

HTTP/2 server push UAF

• curl
• Memory corruption

OpenLDAP SASL authentication bypass

• curl
• CWE-923

SSH improper host validation

• curl
• Weak cryptography or TLS

sending old referer

• curl
• Information disclosure

exposing HTTP/3 early data

• curl
• Information disclosure

UAF after pause in socket callback

• curl
• Memory corruption

stale proxy password leak

• curl
• Hard-coded credentials

incomplete mTLS config matching in conn reuse

• curl
• CWE-305

env-set cross-proxy Digest auth state leak

• curl
• Authentication bypass

password leak with netrc and user in URL

• curl
• Hard-coded credentials

SASL double-free

• curl
• Memory corruption

trailing dot domain super cookie

• curl
• Information disclosure

wrong reuse for different services

• curl
• CWE-488

wrong STARTTLS connection reuse

• curl
• Weak cryptography or TLS

proto-default skips SSH verification

• curl
• Weak cryptography or TLS

cross-origin Digest auth state leak

• curl
• Authentication bypass

WS Auto-PONG memory exhaustion

• curl
• Denial of service

Native CA trust persist

• curl
• Weak cryptography or TLS

QUIC zero-length UDP datagrams busy-loop

• curl
• Denial of service

HTTP/2 stream-dependency tree UAF

• curl
• Memory corruption

cross-proxy Digest auth state leak

• curl
• Authentication bypass

OCSP stapling bypass with Apple SecTrust

• curl

netrc credential leak with reused proxy connection

• curl
• Information disclosure

stale custom cookie host causes cookie leak

• curl
• CWE-346

proxy credentials leak over redirect-to proxy

• curl
• Hard-coded credentials

wrong reuse of SMB connection

• curl
• CWE-488

wrong reuse of HTTP Negotiate connection

• curl
• CWE-305

connection reuse ignores TLS requirement

• curl
• Weak cryptography or TLS

use after free in SMB connection reuse

• curl
• Memory corruption