Bug bounty program · HackerOne
Most upvoted reports682
- #1180380ValidCVE-2021-22901: TLS session caching disastercurl · Memory Corruption · 2021–76votes
- #3125832N/AHTTP/3 Stream Dependency Cycle Exploitcurl · Input Validation and Logic · 2025 · High–60votes
- #3168039ValidCVE-2025-5399: WebSocket endless loopcurl · Denial of Service · 2025 · Low–58votes
- #3591956DuplicateUse-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction)curl · Memory Corruption · 2026 · High–58votes
- #887462ValidCVE-2020-8177: curl overwrite local file with -Jcurl · Input Validation and Logic · 2020–55votes
- #2187833ValidCVE-2023-38545: socks5 heap buffer overflowcurl · Memory Corruption · 2023–55votes
- #3158093SpamMemory Leak in libcurl via Location Header Handling (CWE-770)curl · Denial of Service · 2025 · High–55votes
- #3153497ValidCVE-2025-5025: No QUIC certificate pinning with wolfSSLcurl · Cryptography · 2025 · Medium–54votes
- #4057637Informative[HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenamescurl · File and Path Handling · 2026 · High–54votes
- #2629968ValidCVE-2024-7264: ASN.1 date parser overreadcurl · Memory Corruption · 2024 · Low–53votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.