curl · disclosed reports
Authentication
49 disclosed reports · $0 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open curl on HackerOne- reports
- 49
- paid a bounty
- 0
Every one of the 49 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Negotiate connection reuse with wrong credentials when using CURLAUTH_ANY
- Windows SSPI connection-pool probe can reuse a connection under the wrong user
- Negotiate Authentication Premature on Connection Reuse
- testing hackerone functions
- SSH/SFTP connection reuse can bypass SSH key identity after ssh_config_matches removal
- lib/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a)
- Cross‑origin cookies leak and injection risk when using a custom Host header
- cookie is sent on redirect
- HackerOne Vulnerability Report: libcurl SSL/TLS Identity Leakage via Insecure Connection Reuse
- CVE-2026-5545: wrong reuse of HTTP Negotiate connection
- Incorrect Parsing of IPv6 Zone ID in curl
- 12: SASL DIGEST-MD5 does not validate the server's `rspauth` proof
- CVE-2022-27776: Auth/cookie leak on redirect
- Digest Auth State Leak on Cross-Origin Redirect via Netrc - Username and Password Hash Sent to Wrong Host
- Connection Reuse Ignores OAuth Bearer Token Mismatch
- libcurl: Improper Authentication State Management on Cross-Protocol Redirects
- CVE-2025-14524: bearer token leak on cross-protocol redirect
- TLS conn reuse and session cache ignore fsslctx callback and ssl_config_data flags ( incomplete fix variant of 7541ae569 )
- Missing server identity policy enforcement in SSH connection reuse allows host key verification bypass via pool poisoning
- Speculative Execution Side-Channel in `curl`
- CVE-2026-19931: Negotiate ambient user conn reuse
- Trailing-Dot Hostname in Redirect Silently Strips Client Certificate and Auth Credentials
- ssh_config_matches is dead code: unauthorized SSH key reuse
- curl cross-origin HTTPS redirect reuses TLS client certificate for unintended second-origin mTLS authentication
- SOCKS5 no-auth accepted despite username/password-only authentication
- curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status line
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.