curl · disclosed reports
Denial of Service
37 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open curl on HackerOne- reports
- 37
- paid a bounty
- 0
Every one of the 37 is a mark on the map. Named now: 1 to 26, most upvoted first.
- CVE-2025-5399: WebSocket endless loop
- Memory Leak in libcurl via Location Header Handling (CWE-770)
- Security check up
- HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiB
- WebSocket Fragmentation DoS on Curl Client
- OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients)
- Potential Resource Leak in tool_parsecfg.c at line 279 during fileerror
- Unbounded memory consumption via compressed HTTP responses (gzip/brotli/zstd)
- Disk Space Exhaustion leading to a Denial of Service (DoS)
- HTTP/2 PUSH_PROMISE DoS
- Unbounded GZIP Decompression Leading to Event-Loop Starvation
- CVE-2023-23916: HTTP multi-header compression denial of service
- HTTP/2 CONTINUATION Flood Vulnerability
- Denial of Service (DoS) vulnerability in dedotdotify() URL path normalization
- Memory leak in Curl_auth_create_ntlm_type3_message
- libssh SFTP initialization ignores CURLOPT_TIMEOUT, hangs indefinitely
- CVE-2024-2398: HTTP/2 push headers memory-leak
- MQTT: Missing upper bound on incoming Remaining Length allows server-controlled long wait
- curl_easy_header runs at O(N) or worse and can be abused to use minute(s) of CPU time
- Memory leak from doh_write_cb
- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop
- HTTP/2 proxy CONNECT tunnel unbounded 1xx chain (missing Curl_bump_headersize cap in cf-h2-proxy.c)
- CVE-2026-11586 fix is incomplete: auto-PONG memory grows without limit through curl_ws_recv() (CONNECT_ONLY)
- CVE-2026-11586: WS Auto-PONG memory exhaustion
- Denial of Service in curl Request - HTTP headers eat all memory
- curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode)
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.