Hackers Attack Curl Vulnerability Accessing Sensitive Information #2912277 N/A Information Disclosure Medium 2024-12-27 – 48 Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c #3211973 Informative Information Disclosure Low 2025-06-22 – 41 CVE-2026-7168: cross-proxy Digest auth state leak Analysed #3697719 Valid Information Disclosure Medium 2026-04-29 – 37 Sensitive information disclosure with malicious netrc file #3211126 Informative Information Disclosure Medium 2025-06-22 – 36 CVE-2025-0167: netrc and default credential leak Analysed #2917232 Valid Information Disclosure Low 2025-02-07 – 36 CVE-2024-11053: netrc + redirect credential leak Analysed #2829063 Valid Information Disclosure Low 2024-12-11 – 33 Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts #3952619 Informative Information Disclosure – 2026-08-21 – 31 CVE-2020-8284: trusting FTP PASV responses Analysed #1040166 Valid Information Disclosure Low 2021-02-09 – 30 Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade #4064040 N/A Information Disclosure High 2026-10-05 – 29 libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms #3680680 Informative Information Disclosure Medium 2026-04-19 – 29 Timing Attack Vulnerability in curl Digest Authentication via Non-Constant-Time String Comparison #3346118 N/A Information Disclosure Medium 2025-09-18 – 28 curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/Tor #3306475 N/A Information Disclosure – 2025-08-20 – 28 CVE-2023-46218: cookie mixed case PSL bypass Analysed #2212193 Valid Information Disclosure Medium 2023-12-06 – 28 AWS SigV4 Signature Disclosure via Verbose Logging in libcurl #3361913 N/A Information Disclosure – 2025-10-01 – 27 CVE-2026-3783: token leak with redirect and netrc Analysed #3583983 Valid Information Disclosure Medium 2026-03-11 – 26 Exposure of Private RSA Private Key in curl GitHub Repository #3268294 N/A Information Disclosure – 2025-07-23 – 26 CVE-2026-6276: stale custom cookie host causes cookie leak Analysed #3671818 Valid Information Disclosure Low 2026-04-29 – 24 Vulnerability Report: Public Exposure of Security Audit File #3272982 N/A Information Disclosure Medium 2025-07-27 – 24 libcurl stale CURLOPT_AUTOREFERER leaks a previous request URL to a different origin on a reused easy handle #3673277 Informative Information Disclosure Low 2026-04-17 – 22 CVE-2020-8169: Partial password leak over DNS on HTTP redirect Analysed #874778 Valid Information Disclosure Medium 2020-12-05 – 21 Cookie jar load skips public suffix check on PSL builds #3920276 Informative Information Disclosure Medium 2026-08-14 – 20 Cookie exposure due to unexpected file permission change #1024749 N/A Information Disclosure Medium 2025-10-27 – 20 CVE-2026-6429: netrc credential leak with reused proxy connection Analysed #3677759 Valid Information Disclosure Medium 2026-04-29 – 19 Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure) #3331764 N/A Information Disclosure Medium 2025-09-09 – 19 CURLOPT_UNRESTRICTED_AUTH Dangerous Default Documentation Gap #3595764 N/A Information Disclosure Low 2026-03-10 – 18 Proxy-Authorization header is leaked to origin server after redirect from proxied to direct connection #3480713 N/A Information Disclosure High 2025-12-30 – 18 Cookie attribute truncation in curl drops Secure/HttpOnly protections #4093443 Informative Information Disclosure Low 2026-10-08 – 17 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface #3973127 Informative Information Disclosure – 2026-08-31 – 16 CVE-2026-82209: domain-scoped PSL domain cookie #3972385 Valid Information Disclosure – 2026-09-03 – 15 Secure cookies leaked to HTTP origins through HTTPS forwarding proxy #3803415 N/A Information Disclosure None 2026-06-15 – 15 access notes without permission #3241304 N/A Information Disclosure None 2025-07-08 – 14 Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests #4114965 Informative Information Disclosure Low 2026-10-17 – 13 libcurl reuses a learned RTSP Session header across different hosts on the same easy handle, enabling cross-host session leak and replay #3680234 Informative Information Disclosure Medium 2026-04-18 – 13 Alt-Svc bypasses credential leak protection (CVE-2018-1000007) #3485826 N/A Information Disclosure High 2026-01-04 – 13 Authorization Header Leak via --location-trusted in Curl #2946924 N/A Information Disclosure High 2025-07-03 – 13 41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body #3973158 Informative Information Disclosure – 2026-08-31 – 12 Failure to strip Proxy-Authorization header on change in origin #3180396 N/A Information Disclosure Medium 2025-06-27 – 11 Information Disclosure at : https://curl.se/.mailmap #2853023 N/A Information Disclosure High 2025-07-07 – 11 CVE-2020-8231: Connect-only connections can use the wrong connection #948876 Valid Information Disclosure Low 2020-11-05 – 11 RTSP Digest auth state leaks across origins on reused libcurl easy handle #3776535 Informative Information Disclosure Medium 2026-06-05 – 10 Directory listing vulnerability is disclosing names and emails, widespread (thousands of records, publicly accessible without auth) #3509437 N/A Information Disclosure Critical 2026-01-14 – 10 Git repository found #2915426 N/A Information Disclosure High 2025-07-07 – 10 Redirect to imap/pop3/smtp (SASL) or sftp/scp (libssh) authenticates to the attacker's host with the user's ambient Kerberos credentials #4123571 Informative Information Disclosure Low 2026-10-21 – 9 TFTP upload ignores --continue-at / CURLOPT_RESUME_FROM and leaks skipped local file prefix #3776433 N/A Information Disclosure Medium 2026-06-05 – 9 Disclosure of email addresses #3241308 N/A Information Disclosure None 2025-07-08 – 9 libcurl: Secure=1 cookie flag bypasses the 8.22.0 fix and leaks over HTTP #4071872 Informative Information Disclosure Low 2026-10-06 – 8 07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verification #3973098 N/A Information Disclosure – 2026-09-02 – 8 State Isolation Failure in Multiplexed Connections (Shared Auth Context) #3487952 N/A Information Disclosure Critical 2026-01-08 – 8 CVE-2021-22898: TELNET stack contents disclosure #1176461 Valid Information Disclosure Medium 2021-05-26 – 7 HTTPS proxy connection reuse lets one easy handle inherit another handle's mTLS-authenticated proxy session #3735180 Duplicate Information Disclosure Medium 2026-06-24 – 6