curl · disclosed reports
Memory Corruption
158 disclosed reports · $0 paid
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open curl on HackerOne- reports
- 158
- paid a bounty
- 0
Every one of the 158 is a mark on the map. Named now: 1 to 26, most upvoted first.
- CVE-2021-22901: TLS session caching disaster
- Use-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction)
- CVE-2023-38545: socks5 heap buffer overflow
- Buffer overflow in strcpy
- CVE-2024-7264: ASN.1 date parser overread
- Integer Underflow in src/var.c
- Buffer Overflow Vulnerability in strcpy() Leading to Remote Code Execution
- mbedTLS private-key blob null-termination asymmetry in lib/vtls/mbedtls.c (mbed_load_privkey)
- Buffer Overflow Risk in Curl_inet_ntop and inet_ntop4
- urlapi: off-by-one in custom scheme validation skips last character
- Buffer Overflow Vulnerability in WebSocket Handling
- Integer Overflow in curl_multi_get_handles() Leading to Heap Buffer Overflow
- CVE-2025-9086: Out of bounds read for cookie path
- CVE-2026-3805: use after free in SMB connection reuse
- CVE-2024-6197: freeing stack buffer in utf8asn1str
- Use After Free (that leads to arbitrary Write for some versions)
- Use-After-Free in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurl
- Heap‑based buffer overflow in curl -K <config_file> allows arbitrary write .
- ("possible") UAF
- Cookie Max-Age Integer Overflow Vulnerability
- Out-of-bounds read in HTTP method handling causes undefined behavior and potential crash This is sharp, Gaurav. We’ve got a real memory-safety bug ins
- Integer Overflow in schannel.c TLS Data Transmission
- Memory Leak
- Heap-OOB read in urlapi `redirect_url()` via `CURLU_GUESS_SCHEME` + `CURLU_NO_GUESS_SCHEME` flow
- Stack use-after-scope in HTTP/3 POST request processing via CURLOPT_POSTFIELDS
- Double Free Vulnerability in `libcurl` Cookie Management (`cookie.c`)
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.