curl · disclosed reports
Access Control
18 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open curl on HackerOne- reports
- 18
- paid a bounty
- 0
Every one of the 18 is a mark on the map. Named now: 1 to 18, most upvoted first.
- CVE-2026-3784: wrong proxy connection reuse with credentials
- Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfers
- HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb Tunneling
- Mentioned unites are at the same time .Then we have to increase the bounty.
- HAProxy Connection Reuse leads to IP Spoofing and mTLS Context Smuggling
- no_proxy IDN mismatch: Unicode hostnames bypass proxy exclusion list
- Improper enforcement of CURLOPT_SOCKS5_AUTH due to missing reuse key validation in libcurl
- HTTP/2 PUSH_PROMISE header loss on OOM bypasses scheme validation (regression of 2e8c922a89)
- libcurl Digest/NTLM authentication ignores an explicit Authorization header
- Elevation of Privileges (EoP) vulnerabilities related to the some easy_options on Windows
- 49: Cookie-jar save transfers group access to a different GID
- # SCURLOPT_SSH_KNOWNHOSTS and host fingerprint pins are silently bypassed when an SSH connection is reused from the connection pool
- Hash exposed in public repository
- Github wikis are editable by anyone #Githubwikistakeover
- error parse uri path in curl
- curl overwrites local file with -J option if file non-readable, but file writable.
- curl on Windows can be forced to execute code via OpenSSL environment variables
- match
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP