Credential leak when use two url #1569926 N/A Authentication Medium 2022-06-27 – 3 CVE-2022-32221: POST following PUT confusion #1704017 Valid Input Validation and Logic Medium 2022-11-26 – 3 CVE-2023-27534: SFTP path ~ resolving discrepancy #1892351 Valid File and Path Handling Low 2023-03-22 – 3 CVE-2023-28322: more POST-after-PUT confusion #1954658 Valid Input Validation and Logic Low 2023-05-18 – 3 Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations #3238249 N/A Memory Corruption Medium 2025-07-07 – 3 CVE-2026-8932: incomplete mTLS config matching in conn reuse #3733910 Valid Input Validation and Logic Low 2026-06-24 – 3 CVE-2026-8927: env-set cross-proxy Digest auth state leak #3744543 Valid Authentication Medium 2026-06-24 – 3 CVE-2026-9080: UAF after pause in socket callback #3749204 Valid Memory Corruption Low 2026-06-24 – 3 CVE-2026-9545: exposing HTTP/3 early data #3752888 Valid Cryptography Low 2026-06-24 – 3 CVE-2026-9546: sending old referer #3754343 Valid Memory Corruption Low 2026-06-24 – 3 CURLSHOPT_UNSHARE race can cause UAF in shared SSL session cache during HTTPS transfer #3831345 Informative Memory Corruption – 2026-06-30 – 3 Windows SSPI connection-pool probe can reuse a connection under the wrong user #3938190 N/A Authentication Medium 2026-10-26 – 3 Stacked --proto modifiers leave denied protocol enabled #3970650 Informative No weakness recorded Low 2026-08-28 – 3 28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket #3971496 Informative No weakness recorded Low 2026-08-28 – 3 36: HTTP upload resume offset consumed twice after early 307/308 redirect #3971706 Informative No weakness recorded – 2026-09-07 – 3 34: `curl_mprintf` reads `double` for documented `long double` conversions — uninitialized value disclosure #3972196 Informative No weakness recorded – 2026-08-28 – 3 46: `--libcurl` output carries `--insecure` across `--next` boundaries #3972316 Informative No weakness recorded – 2026-08-28 – 3 10: CURLOPT_MAXLIFETIME_CONN bypass on active HTTP/2 connections #3972323 Informative Cryptography – 2026-09-14 – 3 CVE-2026-87863: HSTS response erases persisted entries #3972373 Valid Race Conditions – 2026-10-14 – 3 CVE-2026-82208: wolfSSL CA-cache hit overrides callback #3973090 Valid Cryptography – 2026-09-03 – 3 56: IBM i CL wrapper `parse_command_line()` never enters quote mode #3973249 Informative Command and Code Injection – 2026-09-14 – 3 Cross-origin redirect reuses a pooled Negotiate-authenticated connection from an unrelated transfer #3981716 N/A No weakness recorded Medium 2026-10-15 – 3 libcurl TLS shorter-retry mismatch discloses client heap memory during cancelled IMAPS upload #4105853 Informative Memory Corruption Medium 2026-10-19 – 3 CVE-2026-111483: GnuTLS accepts non-successful OCSP staples #4116076 Valid Cryptography Medium 2026-10-26 – 3 OpenSSL provider OSSL_LIB_CTX used after free via the connection shutdown list (CVE-2026-80229 fix incomplete) #4118643 Duplicate Memory Corruption Low 2026-10-26 – 3 OpenSSL+Apple SecTrust: SecTrust accepts certificates that the app's CURLOPT_SSL_CTX_FUNCTION trust store or verify callback rejected #4123304 N/A Cryptography Low 2026-10-26 – 3 SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connection #4124583 N/A Cryptography Medium 2026-10-20 – 3 Signed integer overflow in tool_progress_cb() #591770 Informative Memory Corruption None 2019-10-04 – 4 Integer overflows in tool_operate.c at line 1541 #661847 Informative Memory Corruption Low 2021-01-01 – 4 Invalid write (or double free) triggers curl command line tool crash #875775 Informative Memory Corruption High 2020-05-18 – 4 CVE-2021-22923: Metalink download sends credentials #1213181 Valid Cryptography Medium 2021-07-21 – 4 CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 bypass if string not 32 chars #1549461 N/A Input Validation and Logic Medium 2022-04-25 – 4 error parse uri path in curl #1566462 N/A Access Control High 2022-05-13 – 4 Memory leak in CURLOPT_XOAUTH2_BEARER #1567257 Informative Denial of Service Medium 2022-05-13 – 4 CVE-2022-32205: Set-Cookie denial of service #1569946 Valid Denial of Service Low 2022-06-27 – 4 CVE-2022-32206: HTTP compression denial of service #1570651 Valid Denial of Service Medium 2022-06-27 – 4 libssh backend CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 validation bypass #1825377 Informative Input Validation and Logic Low 2023-01-07 – 4 CVE-2023-27533: Telnet option IAC injection #1891474 Valid Injection and Smuggling Low 2023-03-22 – 4 CVE-2023-27535: FTP too eager connection reuse #1892780 Valid Authentication Medium 2023-03-22 – 4 CVE-2023-27536: GSS delegation too eager connection re-use #1895135 Valid Authentication Low 2023-03-22 – 4 CVE-2023-27538: SSH connection too eager reuse still #1898475 Valid Authentication Low 2023-03-22 – 4 OS Command Injection (subprocess Module Usage) #2904921 N/A Command and Code Injection Low 2025-07-07 – 4 Heap buffer overflow in Curl_ipv4_resolve_r due to incorrect buffer alignment and size calculation on AmigaOS #3468410 N/A No weakness recorded – 2025-12-17 – 4 MQTT: unsigned integer underflow bypasses MAX_MQTT_MESSAGE_SIZE check #3508854 N/A No weakness recorded – 2026-01-13 – 4 Stack exhaustion in MIME multipart reading with deeply nested subparts #3684603 N/A Denial of Service Medium 2026-04-29 – 4 CVE-2026-9079: stale proxy password leak #3750295 Valid Information Disclosure Medium 2026-06-24 – 4 CURLOPT_COOKIE leaked to cross-origin redirect target — CURLOPT_UNRESTRICTED_AUTH bypass for the STRING_COOKIE path #3766065 Informative Information Disclosure Medium 2026-06-05 – 4 ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds #3968431 N/A Information Disclosure Low 2026-08-27 – 4 --etag-save - truncates append-redirected stdout #3970639 Informative No weakness recorded Low 2026-08-28 – 4 37: `curl_mprintf` `%F` format specifier not consumed, causing variadic argument desynchronization #3973152 Informative Memory Corruption – 2026-09-14 – 4