Skip to content
Connect AISign inSign up free

Bug bounty reports15,219

Atlas

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:curl
Status
Severity
Weakness:Access Control
Clear
Year
Bounty paid0
Access stated
  • No account0
  • A user account0
  • Admin or privileged0
Access needed
  • No account0
  • A user account1
  • A privileged role0
  • Admin0
  • Physical or local access0
  • Not clear from the report0
Technique
Clear filters18 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
match#1555440N/AAccess ControlHigh2022-06-09––
curl on Windows can be forced to execute code via OpenSSL environment variables#714215InformativeAccess ControlHigh2021-02-08–2
curl overwrites local file with -J option if file non-readable, but file writable.#926638InformativeAccess ControlMedium2020-08-01–3
error parse uri path in curl#1566462N/AAccess ControlHigh2022-05-13–4
Github wikis are editable by anyone #Githubwikistakeover#545052N/AAccess ControlLow2019-05-25–6
Hash exposed in public repository#3419617N/AAccess ControlNone2025-11-11–8
# SCURLOPT_SSH_KNOWNHOSTS and host fingerprint pins are silently bypassed when an SSH connection is reused from the connection pool#3645415N/AAccess Control–2026-04-06–9
49: Cookie-jar save transfers group access to a different GID#3973194InformativeAccess Control–2026-09-08–10
Elevation of Privileges (EoP) vulnerabilities related to the some easy_options on Windows#2941920InformativeAccess ControlHigh2025-07-03–14
libcurl Digest/NTLM authentication ignores an explicit Authorization header#3963330InformativeAccess ControlMedium2026-08-25–14
HTTP/2 PUSH_PROMISE header loss on OOM bypasses scheme validation (regression of 2e8c922a89)#3636044InformativeAccess ControlMedium2026-03-31–15
Improper enforcement of CURLOPT_SOCKS5_AUTH due to missing reuse key validation in libcurl#3650435InformativeAccess ControlLow2026-04-07–15
no_proxy IDN mismatch: Unicode hostnames bypass proxy exclusion list#3650443InformativeAccess Control–2026-04-07–15
HAProxy Connection Reuse leads to IP Spoofing and mTLS Context Smuggling#3475613N/AAccess ControlHigh2025-12-23–16
Mentioned unites are at the same time .Then we have to increase the bounty.#3761789N/AAccess ControlNone2026-06-01–17
HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb Tunneling#3231321N/AAccess ControlHigh2025-07-01–21
Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfers#3741135N/AAccess ControlNone2026-05-19–22
CVE-2026-3784: wrong proxy connection reuse with credentialsAnalysed#3584903ValidAccess ControlLow2026-03-11–30

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated