curl · disclosed reports
Information Disclosure
67 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open curl on HackerOne- reports
- 67
- paid a bounty
- 0
Every one of the 67 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Hackers Attack Curl Vulnerability Accessing Sensitive Information
- Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c
- CVE-2026-7168: cross-proxy Digest auth state leak
- Sensitive information disclosure with malicious netrc file
- CVE-2025-0167: netrc and default credential leak
- CVE-2024-11053: netrc + redirect credential leak
- Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts
- CVE-2020-8284: trusting FTP PASV responses
- Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade
- libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms
- Timing Attack Vulnerability in curl Digest Authentication via Non-Constant-Time String Comparison
- curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/Tor
- CVE-2023-46218: cookie mixed case PSL bypass
- AWS SigV4 Signature Disclosure via Verbose Logging in libcurl
- CVE-2026-3783: token leak with redirect and netrc
- Exposure of Private RSA Private Key in curl GitHub Repository
- CVE-2026-6276: stale custom cookie host causes cookie leak
- Vulnerability Report: Public Exposure of Security Audit File
- libcurl stale CURLOPT_AUTOREFERER leaks a previous request URL to a different origin on a reused easy handle
- CVE-2020-8169: Partial password leak over DNS on HTTP redirect
- Cookie jar load skips public suffix check on PSL builds
- Cookie exposure due to unexpected file permission change
- CVE-2026-6429: netrc credential leak with reused proxy connection
- Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure)
- CURLOPT_UNRESTRICTED_AUTH Dangerous Default Documentation Gap
- Proxy-Authorization header is leaked to origin server after redirect from proxied to direct connection
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.