curl · disclosed reports
Race Conditions
11 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open curl on HackerOne- reports
- 11
- paid a bounty
- 0
Every one of the 11 is a mark on the map. Named now: 1 to 11, most upvoted first.
- curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download write
- curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack
- CVE-2023-32001: fopen race condition
- CVE-2025-0665: eventfd double close
- libcurl cache updates follow symlinks and truncate their targets
- Data race in Curl_dnscache_add_negative() corrupts shared DNS cache — heap corruption and double-free when using CURLOPT_SHARE with CURL_LOCK_DATA_DNS
- [SFTP] TOCTOU Race Condition in Upload Resume Logic Leads to Arbitrary File Append
- TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation Bypass
- Race condition on global `gss_context` during SOCKS5 GSS-API negotiation in libcurl
- CVE-2023-28320: siglongjmp race condition
- CVE-2026-87863: HSTS response erases persisted entries
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.