Double-free of `trailers_buf' on `Curl_http_compile_trailers()` failure #687734 Informative Memory Corruption – 2021-01-12 – – Incorrect IPv6 literal parsing leads to validated connection to unexpected https server. #688048 Informative Injection and Smuggling – 2021-01-12 – – Only OpenSSL handles a CRL when passed in via CApath #713975 Informative Cryptography – 2021-01-08 – – curl successfully matches IP address literal in URL against IP address literal in certificate Common Name #715413 Informative Cryptography – 2021-01-08 – – Port and service scanning on localhost due to improper URL validation. #773313 N/A Information Disclosure – 2020-01-15 – – curl still vulnerable to SMB access smuggling via FILE URL on Windows #812969 Informative Input Validation and Logic – 2021-01-08 – – Curl_auth_create_plain_message integer overflow leads to heap buffer overflow #872089 Informative Memory Corruption – 2021-01-08 – – Data race conditions reported by helgrind when performing parallel DNS queries in libcurl #1019457 Informative Information Disclosure – 2020-11-04 – – match #1555440 N/A Access Control – 2022-06-09 – – Integer overflows in unescape_word() #1564922 N/A Memory Corruption – 2022-06-09 – – CVE-2026-87862: HSTS cache import drops longer-lived child #3972357 Valid Cryptography – 2026-10-14 – – CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection #3972403 Valid Injection and Smuggling – 2026-10-14 – – 14: HSTS cache import silently drops a longer-lived child beneath an includeSubDomains parent #3973124 Duplicate Cryptography – 2026-10-26 – – CVE-2026-86409: stale SigV4 headers sent unintended #3973135 Valid Information Disclosure – 2026-10-14 – – CVE-2026-86410: redirect to SFTP or SCP bypasses host verification #3973176 Valid Cryptography – 2026-10-14 – – CVE-2026-86412: server-set cookie erases cookie jar #3973201 Valid Input Validation and Logic – 2026-10-14 – – CVE-2026-87865: knownhost callback mismatches key as missing #3975408 Valid Cryptography Low 2026-10-14 – – CVE-2026-86414: leaking host credentials to HTTP proxy #3993566 Valid No weakness recorded Low 2026-10-14 – – CVE-2026-92386: server-set cookie aborts cookie jar load #4021979 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92387: never-ending loop via server response omission #4022003 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92388: FTP wildcard write callback mixup #4022070 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92389: TFTP direction confusion #4022568 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints #4023192 Valid No weakness recorded None 2026-10-14 – – libcurl: SMTP end-of-response out-of-bounds read - CVE-2019-3823 #518097 Informative Memory Corruption – 2021-01-08 – 1 huge COLUMNS causes progress-bar to buffer overflow #636013 Informative Memory Corruption – 2021-02-08 – 1 Insecure Frame (External) #640530 N/A No weakness recorded – 2019-11-01 – 1 Integer overflow at line 1603 in the src/operator.c file #662412 Informative Memory Corruption – 2021-02-08 – 1 Buffer write overflow when forming dns over http request #694449 Informative Memory Corruption – 2021-02-08 – 1 Resource leak when using a normal site as DOH server #694988 Informative No weakness recorded – 2021-02-08 – 1 Potential invocation of qsort on uninitialized memory during cookie save #696822 Informative Memory Corruption – 2021-02-08 – 1 use after free in cookie.c #707006 Informative Memory Corruption – 2021-02-08 – 1 Race condition with CURL_LOCK_DATA_CONNECT can cause connections to be used at the same time #724134 Informative Memory Corruption – 2021-01-08 – 1 Unexpected access to process open files via file:///proc/self/fd/n #770190 Informative Information Disclosure – 2021-02-08 – 1 Division by zero if terminal width is 2 #774883 Informative Input Validation and Logic – 2021-02-08 – 1 Parallel upload hangs curl if upload file not found #1019372 Informative Denial of Service – 2020-10-29 – 1 Inadequate Cryptographic Key Size and Insecure Cryptographic Mode. File Name :- curl_ntlm_core.c #1113663 N/A Cryptography – 2021-03-08 – 1 Occasional use-after-free in multi_done() libcurl-7.81.0 #1463013 Informative Memory Corruption – 2022-03-09 – 1 Use of Unsafe function || Strcpy #1485379 N/A Memory Corruption – 2022-03-09 – 1 curl proceeds with unsafe connections when -K file can't be read #1542881 Informative Input Validation and Logic – 2022-04-21 – 1 curl "globbing" can lead to denial of service attacks #1572120 N/A Denial of Service – 2022-06-16 – 1 KRB-FTP: Security level downgrade #1590102 N/A Input Validation and Logic – 2022-06-05 – 1 CVE-2026-8924: trailing dot domain super cookie #3733905 Valid Input Validation and Logic Low 2026-06-24 – 1 SMTP connection reuse ignores --ssl-reqd / CURLOPT_USE_SSL and reuses a clear-text STARTTLS session on current master #3770979 N/A Cryptography Low 2026-06-03 – 1 PRE_PROXY change leaks stale Proxy Digest state across proxy-chain boundary #3777381 N/A Information Disclosure – 2026-06-03 – 1 20: HTAB before `Secure` attribute silently drops the Secure cookie flag #3971551 Duplicate No weakness recorded – 2026-10-26 – 1 CVE-2026-87861: cross-origin reuse of a Negotiate connection #3972094 Valid Authentication Low 2026-10-14 – 1 CVE-2026-80255: secure cookie attribute bypass with tab #3972395 Valid Input Validation and Logic – 2026-09-03 – 1 CVE-2026-86411: FTP connection reuse inherits client-certificate #3973190 Valid Authentication – 2026-10-14 – 1 CVE-2026-94265: Authorization: Negotiate sent to foreign origin #4040551 Valid No weakness recorded None 2026-10-14 – 1 CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL #4041053 Valid No weakness recorded None 2026-10-14 – 1