Port and service scanning on localhost due to improper URL validation. #773313 N/A Information Disclosure Medium 2020-01-15 – – Data race conditions reported by helgrind when performing parallel DNS queries in libcurl #1019457 Informative Information Disclosure Medium 2020-11-04 – – CVE-2026-86409: stale SigV4 headers sent unintended #3973135 Valid Information Disclosure – 2026-10-14 – – Unexpected access to process open files via file:///proc/self/fd/n #770190 Informative Information Disclosure High 2021-02-08 – 1 PRE_PROXY change leaks stale Proxy Digest state across proxy-chain boundary #3777381 N/A Information Disclosure – 2026-06-03 – 1 Cross-protocol redirect to imap:// or smtp:// uploads the -F/MIMEPOST form and the custom Authorization/Cookie headers to the redirect target #4123474 N/A Information Disclosure Low 2026-10-26 – 1 Libcurl ocasionally sends HTTPS traffic to port 443 rather than specified port 8080 #637800 Informative Information Disclosure Medium 2021-02-03 – 2 CVE-2026-8926: password leak with netrc and user in URL #3735184 Valid Information Disclosure Low 2026-06-24 – 2 CVE-2026-11856: cross-origin Digest auth state leak #3793260 Valid Information Disclosure Medium 2026-06-24 – 2 CVE-2021-22925: TELNET stack contents disclosure again #1223882 Valid Information Disclosure Low 2021-07-21 – 3 CVE-2026-9079: stale proxy password leak #3750295 Valid Information Disclosure Medium 2026-06-24 – 4 CURLOPT_COOKIE leaked to cross-origin redirect target — CURLOPT_UNRESTRICTED_AUTH bypass for the STRING_COOKIE path #3766065 Informative Information Disclosure Medium 2026-06-05 – 4 ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds #3968431 N/A Information Disclosure Low 2026-08-27 – 4 Remote memory disclosure vulnerability in libcurl on 64 Bit Windows #1444539 Informative Information Disclosure High 2022-02-21 – 5 CVE-2022-27779: cookie for trailing dot TLD #1553301 Valid Information Disclosure Medium 2022-05-11 – 5 Low priority HSTS bypass in curl_easy_duphandle() #3769293 Informative Information Disclosure Low 2026-06-01 – 5 CVE-2026-107929: local interface connection reuse mixup #4099618 Valid Information Disclosure Low 2026-10-14 – 5 HTTPS proxy connection reuse lets one easy handle inherit another handle's mTLS-authenticated proxy session #3735180 Duplicate Information Disclosure Medium 2026-06-24 – 6 CVE-2021-22898: TELNET stack contents disclosure #1176461 Valid Information Disclosure Medium 2021-05-26 – 7 State Isolation Failure in Multiplexed Connections (Shared Auth Context) #3487952 N/A Information Disclosure Critical 2026-01-08 – 8 07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verification #3973098 N/A Information Disclosure – 2026-09-02 – 8 libcurl: Secure=1 cookie flag bypasses the 8.22.0 fix and leaks over HTTP #4071872 Informative Information Disclosure Low 2026-10-06 – 8 Disclosure of email addresses #3241308 N/A Information Disclosure None 2025-07-08 – 9 TFTP upload ignores --continue-at / CURLOPT_RESUME_FROM and leaks skipped local file prefix #3776433 N/A Information Disclosure Medium 2026-06-05 – 9 Redirect to imap/pop3/smtp (SASL) or sftp/scp (libssh) authenticates to the attacker's host with the user's ambient Kerberos credentials #4123571 Informative Information Disclosure Low 2026-10-21 – 9 Git repository found #2915426 N/A Information Disclosure High 2025-07-07 – 10 Directory listing vulnerability is disclosing names and emails, widespread (thousands of records, publicly accessible without auth) #3509437 N/A Information Disclosure Critical 2026-01-14 – 10 RTSP Digest auth state leaks across origins on reused libcurl easy handle #3776535 Informative Information Disclosure Medium 2026-06-05 – 10 CVE-2020-8231: Connect-only connections can use the wrong connection #948876 Valid Information Disclosure Low 2020-11-05 – 11 Information Disclosure at : https://curl.se/.mailmap #2853023 N/A Information Disclosure High 2025-07-07 – 11 Failure to strip Proxy-Authorization header on change in origin #3180396 N/A Information Disclosure Medium 2025-06-27 – 11 41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body #3973158 Informative Information Disclosure – 2026-08-31 – 12 Authorization Header Leak via --location-trusted in Curl #2946924 N/A Information Disclosure High 2025-07-03 – 13 Alt-Svc bypasses credential leak protection (CVE-2018-1000007) #3485826 N/A Information Disclosure High 2026-01-04 – 13 libcurl reuses a learned RTSP Session header across different hosts on the same easy handle, enabling cross-host session leak and replay #3680234 Informative Information Disclosure Medium 2026-04-18 – 13 Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests #4114965 Informative Information Disclosure Low 2026-10-17 – 13 access notes without permission #3241304 N/A Information Disclosure None 2025-07-08 – 14 Secure cookies leaked to HTTP origins through HTTPS forwarding proxy #3803415 N/A Information Disclosure None 2026-06-15 – 15 CVE-2026-82209: domain-scoped PSL domain cookie #3972385 Valid Information Disclosure – 2026-09-03 – 15 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface #3973127 Informative Information Disclosure – 2026-08-31 – 16 Cookie attribute truncation in curl drops Secure/HttpOnly protections #4093443 Informative Information Disclosure Low 2026-10-08 – 17 Proxy-Authorization header is leaked to origin server after redirect from proxied to direct connection #3480713 N/A Information Disclosure High 2025-12-30 – 18 CURLOPT_UNRESTRICTED_AUTH Dangerous Default Documentation Gap #3595764 N/A Information Disclosure Low 2026-03-10 – 18 Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure) #3331764 N/A Information Disclosure Medium 2025-09-09 – 19 CVE-2026-6429: netrc credential leak with reused proxy connection Analysed #3677759 Valid Information Disclosure Medium 2026-04-29 – 19 Cookie exposure due to unexpected file permission change #1024749 N/A Information Disclosure Medium 2025-10-27 – 20 Cookie jar load skips public suffix check on PSL builds #3920276 Informative Information Disclosure Medium 2026-08-14 – 20 CVE-2020-8169: Partial password leak over DNS on HTTP redirect Analysed #874778 Valid Information Disclosure Medium 2020-12-05 – 21 libcurl stale CURLOPT_AUTOREFERER leaks a previous request URL to a different origin on a reused easy handle #3673277 Informative Information Disclosure Low 2026-04-17 – 22 Vulnerability Report: Public Exposure of Security Audit File #3272982 N/A Information Disclosure Medium 2025-07-27 – 24