curl · disclosed reports
Cryptography
89 disclosed reports · $0 paid · 35 valid · 20 informative · 1 duplicate · 33 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open curl on HackerOne- reports
- 89
- valid
- 35
- paid a bounty
- 0
Every one of the 89 is a mark on the map. Named now: 1 to 26, most upvoted first.
- CVE-2025-5025: No QUIC certificate pinning with wolfSSL
- CVE-2020-8286: Inferior OCSP verification
- `Curl_socketpair()` fallback vulnerable to man-in-the-middle attack
- CVE-2025-10966: missing SFTP host verification with wolfSSH
- CVE-2025-4947: QUIC certificate check skip with wolfSSL
- curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session Hijacking
- CVE-2024-8096: OCSP stapling bypass with GnuTLS
- CVE-2026-7009: OCSP stapling bypass with Apple SecTrust
- on the implications of permitting procedural culling
- SSL options ISSUERCERT, EC_CURVES and CRLFILE silently ignored by non-OpenSSL backends
- Apple SecTrust legacy path accepts untrusted certificates on pre-10.14 macOS/iOS when built with USE_APPLE_SECTRUST
- CVE-2025-10148: predictable WebSocket mask
- bypass of this Fixed #2437131 [ Inadequate Protocol Restriction Enforcement in curl ]
- CVE-2023-46219: HSTS long file name clears contents
- Default Minimum TLS Version Set to TLS v1.0 (Cryptographic Weakness)
- HSTS accepted from HTTP origin behind HTTPS proxy
- curl GnuTLS backend accepts a clientAuth-only certificate for HTTPS server authentication
- GnuTLS OCSP stapling accepts unrelated SingleResponse (no cert-ID binding)
- CVE-2024-0853: OCSP verification bypass with TLS session reuse
- Able to bypass HSTS using trailing dot
- Use of a Broken or Risky Cryptographic Algorithm (CWE-327) in libcurl
- Insecure WebSocket Usage in curl Documentation and Examples (CWE-319: Cleartext Transmission of Sensitive Information)
- mbedTLS / wolfSSL / rustls backends silently skip hostname verification when CURLOPT_SSL_VERIFYPEER=0
- CVE-2025-15079: libssh global knownhost override
- curl built with GnuTLS backend defaults to weak crypto parameters
- SSL session-cache peer key omits signature_algorithms: strict-sigalg handle silently resumes a permissive sibling's session
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.