HTTP/3 Stream Dependency Cycle Exploit #3125832 N/A Input Validation and Logic High 2025-05-04 – 60 CVE-2020-8177: curl overwrite local file with -J Analysed #887462 Valid Input Validation and Logic Medium 2020-12-05 – 55 CVE-2024-9681: HSTS subdomain overwrites parent cache entry Analysed #2764830 Valid Input Validation and Logic Low 2024-11-06 – 49 MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstate #3702718 Informative Input Validation and Logic Medium 2026-04-29 – 36 CVE-2024-2004: Usage of disabled protocol Analysed #2384833 Valid Input Validation and Logic Low 2024-03-27 – 33 Schannel custom-CA path skips Extended Key Usage enforcement #3734992 Informative Input Validation and Logic – 2026-05-19 – 30 Curl_compareheader() fails to match multi-value HTTP headers #3598444 Informative Input Validation and Logic Medium 2026-03-12 – 28 RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload) #3575250 Informative Input Validation and Logic None 2026-02-26 – 28 URL API: triple-slash parses path segment as hostname #3923212 N/A Input Validation and Logic Medium 2026-08-07 – 27 HTTP/2 server push accepts a non-authoritative :scheme=https over cleartext h2c, enabling HTTPS cache-key poisoning #3630310 Informative Input Validation and Logic High 2026-03-29 – 26 curl ASSERTs when accessing an LDAP URL #3258022 Informative Input Validation and Logic – 2025-07-22 – 24 Missing applicability validation allows non-applicable HTTPS RR to reach ECH processing #4053066 N/A Input Validation and Logic Medium 2026-09-26 – 22 IMAP connection reuse runs requests in the wrong case-sensitive mailbox #3976342 Informative Input Validation and Logic Low 2026-09-10 – 22 Hi Hacker #3409186 N/A Input Validation and Logic None 2025-11-03 – 22 Inconsistent URL Parsing in curl Leading to Potential SSRF and Access Control Bypass #2814750 N/A Input Validation and Logic Low 2025-09-26 – 22 Functional Regression in Digest Authentication: Failure to handle optional spaces and escaped quotes #3473384 Informative Input Validation and Logic Low 2025-12-21 – 20 PROTOCOL-LEVEL: Persistent UDP Amplification and Cache Poisoning via Alt-Svc Logic Flaw #3483902 Informative Input Validation and Logic High 2026-01-02 – 19 When curl uses Schannel as TLS backend, it fails to enforce TLS 1.3 cipher suite selections correctly #2792484 Informative Input Validation and Logic Medium 2024-11-04 – 19 Cookie attribute TAB injection regression in Set-Cookie parsing #3641893 Informative Input Validation and Logic Low 2026-04-03 – 18 libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request #4113412 Informative Input Validation and Logic Low 2026-10-17 – 16 verify-release rebuilds from the tarball under verification, enabling pre-check command execution and false OK for a malicious curl release tarball #3802645 N/A Input Validation and Logic Medium 2026-06-17 – 16 CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple builds #3735179 Informative Input Validation and Logic None 2026-05-19 – 15 Unsafe Global IFS Modification in OS400 Shell Script Enables Command Injection and Parsing Flaws (CWE-78/CWE-20) #3295656 N/A Input Validation and Logic High 2025-08-12 – 15 IMAP Protocol Desynchronization and Response Smuggling via Naive Literal Parsing #3509396 Informative Input Validation and Logic Low 2026-01-14 – 14 curl --continue-at confusion #2859735 N/A Input Validation and Logic Medium 2025-07-07 – 14 CVE-2021-22897: schannel cipher selection surprise #1172857 Valid Input Validation and Logic Low 2021-05-26 – 14 cookie: case-insensitive path comparison in replace_existing() allows cookie eviction across distinct paths #3735238 Informative Input Validation and Logic – 2026-05-18 – 13 CVE-2022-35252: control code in cookie denial of service #1613943 Valid Input Validation and Logic Low 2022-08-31 – 13 DNS domain search list followed for extant domain missing A or AAAA records #3780733 N/A Input Validation and Logic Low 2026-06-08 – 12 A logic error in detect_proxy caused truncation of environment variable names for long protocol schemes. #3473182 N/A Input Validation and Logic Low 2025-12-21 – 12 Missing enforcement of SFTP quote syntax can lead to operation on wrong object #3379102 N/A Input Validation and Logic – 2025-10-12 – 12 42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions #3973169 Informative Input Validation and Logic – 2026-08-29 – 11 TLS peer-verification bypass via mid-transfer ssl_config mutation #3735276 N/A Input Validation and Logic – 2026-05-19 – 11 CVE-2022-32208: FTP-KRB bad message verification #1590071 Valid Input Validation and Logic Low 2022-06-27 – 11 CVE-2022-27778: curl removes wrong file on error #1553598 Valid Input Validation and Logic Medium 2022-05-11 – 11 Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN match #3734921 Informative Input Validation and Logic None 2026-05-17 – 10 Logical Flaw in curl_url_set Leads to Inconsistent Query Parameter Encoding #3403880 N/A Input Validation and Logic Medium 2025-10-29 – 10 [High] MITM via Insecure CA Path Handling in cURL (--capath, CURLOPT_CAPATH) (CWE-494: Download of Code Without Integrity Check) #3120969 N/A Input Validation and Logic High 2025-06-30 – 10 SMB access smuggling via FILE URL on Windows #726117 N/A Input Validation and Logic None 2021-01-17 – 10 ignoring 'options' when doing connection reuse #3646914 Informative Input Validation and Logic – 2026-04-05 – 9 WebSocket Logic Error: Control Frame (PING/PONG) Starvation causes Connection Drop (DoS) during large transfers #3480039 Informative Input Validation and Logic Medium 2025-12-28 – 9 Cache purge requests are not authenticated #1994585 Informative Input Validation and Logic Medium 2023-05-20 – 9 rustls backend silently ignores CURLOPT_CRLFILE when native CA store is active #3734935 Informative Input Validation and Logic – 2026-05-18 – 8 Arbitrary File Deletion Vulnerability in curl Source Code via os.unlink() #2864414 N/A Input Validation and Logic High 2025-07-07 – 8 curl/libcurl vulnerable to TLS truncation attacks #1826392 N/A Input Validation and Logic Medium 2026-06-10 – 8 TLS verifyhost bypass in rustls, mbedTLS, and wolfSSL when verifypeer=0 #3734095 Informative Input Validation and Logic – 2026-05-19 – 7 curl file writing susceptible to symlink attacks #1814824 Informative Input Validation and Logic Low 2023-01-07 – 7 CVE-2022-27775: Bad local IPv6 connection reuse #1546268 Valid Input Validation and Logic Low 2022-04-27 – 7 CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entry #4137523 N/A Input Validation and Logic Low 2026-10-23 – 6 -H with space prefix leads to previous header injection when used with --proxy #2864859 N/A Input Validation and Logic Medium 2025-07-07 – 6