curl · disclosed reports
Injection and Smuggling
44 disclosed reports · $0 paid
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open curl on HackerOne- reports
- 44
- paid a bounty
- 0
Every one of the 44 is a mark on the map. Named now: 1 to 26, most upvoted first.
- CRLF Injection in `--proxy-header` allows extra HTTP headers (CWE-93)
- HTTP/1.1 Response Desynchronization via conflicting CL/TE headers in Proxy CONNECT
- HTTP/1.1 response framing violation and unsafe connection reuse when transfer decoding is disabled
- Unescaped username in SASL DIGEST-MD5 response allows injection
- HTTP/3 Protocol Smuggling and Header Injection via CRLF in QPACK value conversion
- wcurl treats some URL operands after -- as curl options
- HTTP Request Smuggling Vulnerability Analysis - cURL Security Report
- Incomplete Suppression of Transfer-Encoding: chunked Header in HTTP/2 After Redirect From HTTP/1.1
- CRLF injection in libcurl's SMTP client via --mail-from and --mail-rcpt allows SMTP command smuggling
- CRLF Injection via Custom HTTP Headers
- HTTP/2 and HTTP/3 Header Injection in curl
- Protocol Smuggling / CRLF Injection via Gopher Protocol allows Arbitrary Command Injection
- SMTP CRLF injection in custom SMTP recipient operand allows additional SMTP commands after authentication
- libcurl LDAP LDIF: entry DN and attribute names written without RFC 2849 base64 encoding, allowing server line injection
- Duplicate chunked Transfer-Encoding lets a malicious origin smuggle a response across reused HTTP proxy connections
- libcurl: HTTP/1.x bare LF byte in response header value enables cookie jar pollution and POST body/credential exfiltration via redirect — RC=0, curl 8
- SMTP Command Injection Vulnerability in libcurl 8.16.0 via RFC 3461 Suffix
- RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions
- In curl's SASL OAUTHBEARER authentication, including the SOH character (0x01) in the username corrupts the message structure.
- HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)
- SMTP CRLF Injection & Protocol Desynchronization in libcurl
- Security Vulnerability Report: Protocol Injection via Programmatic Options
- CURLOPT_HAPROXY_CLIENT_IP lacks input validation, enabling HAProxy PROXY protocol injection
- Encoded slash traversal in the IPFS/IPNS URL rewrite escapes the configured gateway namespace
- SMTP CRLF Command Injection in CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT
- CRLF Injection in HAProxy PROXY Protocol via CURLOPT_HAPROXY_CLIENT_IP allows IP spoofing and protocol injection
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.