CVE-2025-5399: WebSocket endless loop Analysed #3168039 Valid Denial of Service Low 2025-06-04 – 58 Memory Leak in libcurl via Location Header Handling (CWE-770) #3158093 Spam Denial of Service High 2025-05-22 – 55 Security check up #3269761 N/A Denial of Service Low 2025-07-24 – 44 HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiB #3734947 N/A Denial of Service – 2026-05-19 – 39 WebSocket Fragmentation DoS on Curl Client #3303765 N/A Denial of Service High 2025-08-19 – 32 OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients) #3373640 Informative Denial of Service Low 2025-10-08 – 30 Potential Resource Leak in tool_parsecfg.c at line 279 during fileerror #3710209 N/A Denial of Service Low 2026-05-05 – 21 Unbounded memory consumption via compressed HTTP responses (gzip/brotli/zstd) #3471553 Informative Denial of Service Medium 2025-12-21 – 21 Disk Space Exhaustion leading to a Denial of Service (DoS) #3250490 Spam Denial of Service Medium 2025-07-14 – 21 HTTP/2 PUSH_PROMISE DoS #2402853 Informative Denial of Service Medium 2024-03-27 – 20 Unbounded GZIP Decompression Leading to Event-Loop Starvation #3632427 N/A Denial of Service Medium 2026-03-31 – 17 CVE-2023-23916: HTTP multi-header compression denial of service #1826048 Valid Denial of Service Medium 2023-02-20 – 16 HTTP/2 CONTINUATION Flood Vulnerability #3125820 N/A Denial of Service High 2025-06-28 – 14 Denial of Service (DoS) vulnerability in dedotdotify() URL path normalization #3463608 N/A Denial of Service High 2025-12-13 – 13 Memory leak in Curl_auth_create_ntlm_type3_message #3393539 Informative Denial of Service Low 2025-10-28 – 13 libssh SFTP initialization ignores CURLOPT_TIMEOUT, hangs indefinitely #3735080 N/A Denial of Service – 2026-05-18 – 12 CVE-2024-2398: HTTP/2 push headers memory-leak #2402845 Valid Denial of Service Medium 2024-03-27 – 12 MQTT: Missing upper bound on incoming Remaining Length allows server-controlled long wait #3488278 N/A Denial of Service Low 2026-01-06 – 10 curl_easy_header runs at O(N) or worse and can be abused to use minute(s) of CPU time #3133253 Informative Denial of Service – 2025-07-01 – 9 Memory leak from doh_write_cb #3089595 Informative Denial of Service None 2025-06-29 – 9 CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop #3783438 Valid Denial of Service Low 2026-06-24 – 7 HTTP/2 proxy CONNECT tunnel unbounded 1xx chain (missing Curl_bump_headersize cap in cf-h2-proxy.c) #3734020 Informative Denial of Service None 2026-05-19 – 7 CVE-2026-11586 fix is incomplete: auto-PONG memory grows without limit through curl_ws_recv() (CONNECT_ONLY) #4123050 Informative Denial of Service Low 2026-10-21 – 6 CVE-2026-11586: WS Auto-PONG memory exhaustion #3788931 Valid Denial of Service Low 2026-06-24 – 6 Denial of Service in curl Request - HTTP headers eat all memory #2552192 N/A Denial of Service Medium 2024-06-18 – 6 curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode) #4125065 Informative Denial of Service Medium 2026-10-23 – 5 CVE-2022-27781: CERTINFO never-ending busy-loop #1555441 Valid Denial of Service Low 2022-05-16 – 5 passive FTPS data connection handshake blocks curl_multi_perform() with no timeout (regression in 8.19.0) #4122567 Informative Denial of Service Low 2026-10-23 – 4 Stack exhaustion in MIME multipart reading with deeply nested subparts #3684603 N/A Denial of Service Medium 2026-04-29 – 4 CVE-2022-32206: HTTP compression denial of service #1570651 Valid Denial of Service Medium 2022-06-27 – 4 CVE-2022-32205: Set-Cookie denial of service #1569946 Valid Denial of Service Low 2022-06-27 – 4 Memory leak in CURLOPT_XOAUTH2_BEARER #1567257 Informative Denial of Service Medium 2022-05-13 – 4 Denial of Service vulnerability in curl when parsing MQTT server response #1521610 Informative Denial of Service Medium 2022-03-28 – 3 CVE-2020-8285: FTP wildcard stack overflow #1045844 Valid Denial of Service Medium 2021-01-08 – 3 Poll loop/hang on incomplete HTTP header #889160 Informative Denial of Service Medium 2021-01-22 – 3 curl "globbing" can lead to denial of service attacks #1572120 N/A Denial of Service Low 2022-06-16 – 1 Parallel upload hangs curl if upload file not found #1019372 Informative Denial of Service None 2020-10-29 – 1