Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
CVE-2026-87863: HSTS response erases persisted entries#3972373	Valid	Race Conditions	–	2026-10-14	–	3
CVE-2023-28320: siglongjmp race condition#1929597	Valid	Race Conditions	Low	2023-05-17	–	6
Race condition on global `gss_context` during SOCKS5 GSS-API negotiation in libcurl#3356088	Informative	Race Conditions	Medium	2025-09-26	–	17
TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation Bypass#3335085	N/A	Race Conditions	High	2025-09-11	–	23
[SFTP] TOCTOU Race Condition in Upload Resume Logic Leads to Arbitrary File Append#3432833	Informative	Race Conditions	Medium	2025-11-24	–	23
Data race in Curl_dnscache_add_negative() corrupts shared DNS cache — heap corruption and double-free when using CURLOPT_SHARE with CURL_LOCK_DATA_DNS#3645361	Informative	Race Conditions	Medium	2026-04-04	–	23
libcurl cache updates follow symlinks and truncate their targets#3938220	N/A	Race Conditions	Low	2026-08-14	–	23
CVE-2025-0665: eventfd double closeAnalysed#2954286	Valid	Race Conditions	Low	2025-02-07	–	24
CVE-2023-32001: fopen race conditionAnalysed#2039870	Valid	Race Conditions	Medium	2023-07-25	–	26
curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack#3955945	N/A	Race Conditions	Critical	2026-08-26	–	30
curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download write#3747959	N/A	Race Conditions	Medium	2026-05-20	–	42

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.