curl · disclosed reports
Input Validation and Logic
74 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open curl on HackerOne- reports
- 74
- paid a bounty
- 0
Every one of the 74 is a mark on the map. Named now: 1 to 26, most upvoted first.
- HTTP/3 Stream Dependency Cycle Exploit
- CVE-2020-8177: curl overwrite local file with -J
- CVE-2024-9681: HSTS subdomain overwrites parent cache entry
- MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstate
- CVE-2024-2004: Usage of disabled protocol
- Schannel custom-CA path skips Extended Key Usage enforcement
- Curl_compareheader() fails to match multi-value HTTP headers
- RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload)
- URL API: triple-slash parses path segment as hostname
- HTTP/2 server push accepts a non-authoritative :scheme=https over cleartext h2c, enabling HTTPS cache-key poisoning
- curl ASSERTs when accessing an LDAP URL
- Missing applicability validation allows non-applicable HTTPS RR to reach ECH processing
- IMAP connection reuse runs requests in the wrong case-sensitive mailbox
- Hi Hacker
- Inconsistent URL Parsing in curl Leading to Potential SSRF and Access Control Bypass
- Functional Regression in Digest Authentication: Failure to handle optional spaces and escaped quotes
- PROTOCOL-LEVEL: Persistent UDP Amplification and Cache Poisoning via Alt-Svc Logic Flaw
- When curl uses Schannel as TLS backend, it fails to enforce TLS 1.3 cipher suite selections correctly
- Cookie attribute TAB injection regression in Set-Cookie parsing
- libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request
- verify-release rebuilds from the tarball under verification, enabling pre-check command execution and false OK for a malicious curl release tarball
- CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple builds
- Unsafe Global IFS Modification in OS400 Shell Script Enables Command Injection and Parsing Flaws (CWE-78/CWE-20)
- IMAP Protocol Desynchronization and Response Smuggling via Naive Literal Parsing
- curl --continue-at confusion
- CVE-2021-22897: schannel cipher selection surprise
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.