Double-free of `trailers_buf' on `Curl_http_compile_trailers()` failure #687734 Informative Memory Corruption Medium 2021-01-12 – – Incorrect IPv6 literal parsing leads to validated connection to unexpected https server. #688048 Informative Injection and Smuggling Medium 2021-01-12 – – Port and service scanning on localhost due to improper URL validation. #773313 N/A Information Disclosure Medium 2020-01-15 – – Data race conditions reported by helgrind when performing parallel DNS queries in libcurl #1019457 Informative Information Disclosure Medium 2020-11-04 – – CVE-2026-111952: OpenSSL provider use-after-free again #4122239 Valid Memory Corruption Medium 2026-10-26 – 1 wolfSSL Backend Silently Ignores --cert-status (OCSP Stapling Bypass) #4127399 N/A Cryptography Medium 2026-10-20 – 1 Libcurl ocasionally sends HTTPS traffic to port 443 rather than specified port 8080 #637800 Informative Information Disclosure Medium 2021-02-03 – 2 Proxy-Authorization header carried to a new host on a redirect #1086259 N/A Cryptography Medium 2021-03-08 – 2 CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 comparison disaster #1549435 N/A Cryptography Medium 2022-04-25 – 2 Certificate authentication re-use on redirect #1563061 N/A Input Validation and Logic Medium 2022-05-11 – 2 CVE-2022-42916: HSTS bypass via IDN #1730660 Valid Cryptography Medium 2022-10-27 – 2 CVE-2026-8925: SASL double-free #3735193 Valid Memory Corruption Medium 2026-06-24 – 2 Proxy CONNECT response poisoning via authentication retry in cf-h1-proxy.c (libcurl) #3767963 Informative Input Validation and Logic Medium 2026-06-03 – 2 curl/libcurl 8.20.0 NOPROXY bypass via uppercase-hex IPv4 aliases leaks off-proxy Basic credentials to the configured proxy #3773293 Informative No weakness recorded Medium 2026-06-03 – 2 CVE-2026-11856: cross-origin Digest auth state leak #3793260 Valid Information Disclosure Medium 2026-06-24 – 2 CVE-2026-87866: wolfSSL public-key pinning bypass #3989514 Valid Cryptography Medium 2026-10-14 – 2 GnuTLS + Apple SecTrust discards authenticated OCSP failure #4124276 N/A Cryptography Medium 2026-10-26 – 2 OpenSSL `--cert-status` accepts indefinitely stale GOOD OCSP staples #4125601 N/A Cryptography Medium 2026-10-26 – 2 Poll loop/hang on incomplete HTTP header #889160 Informative Denial of Service Medium 2021-01-22 – 3 curl overwrites local file with -J option if file non-readable, but file writable. #926638 Informative Access Control Medium 2020-08-01 – 3 CVE-2020-8285: FTP wildcard stack overflow #1045844 Valid Denial of Service Medium 2021-01-08 – 3 Denial of Service vulnerability in curl when parsing MQTT server response #1521610 Informative Denial of Service Medium 2022-03-28 – 3 Credential leak when use two url #1569926 N/A Authentication Medium 2022-06-27 – 3 CVE-2022-32221: POST following PUT confusion #1704017 Valid Input Validation and Logic Medium 2022-11-26 – 3 Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations #3238249 N/A Memory Corruption Medium 2025-07-07 – 3 CVE-2026-8927: env-set cross-proxy Digest auth state leak #3744543 Valid Authentication Medium 2026-06-24 – 3 Windows SSPI connection-pool probe can reuse a connection under the wrong user #3938190 N/A Authentication Medium 2026-10-26 – 3 Cross-origin redirect reuses a pooled Negotiate-authenticated connection from an unrelated transfer #3981716 N/A No weakness recorded Medium 2026-10-15 – 3 libcurl TLS shorter-retry mismatch discloses client heap memory during cancelled IMAPS upload #4105853 Informative Memory Corruption Medium 2026-10-19 – 3 CVE-2026-111483: GnuTLS accepts non-successful OCSP staples #4116076 Valid Cryptography Medium 2026-10-26 – 3 SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connection #4124583 N/A Cryptography Medium 2026-10-20 – 3 CVE-2021-22923: Metalink download sends credentials #1213181 Valid Cryptography Medium 2021-07-21 – 4 CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 bypass if string not 32 chars #1549461 N/A Input Validation and Logic Medium 2022-04-25 – 4 Memory leak in CURLOPT_XOAUTH2_BEARER #1567257 Informative Denial of Service Medium 2022-05-13 – 4 CVE-2022-32206: HTTP compression denial of service #1570651 Valid Denial of Service Medium 2022-06-27 – 4 CVE-2023-27535: FTP too eager connection reuse #1892780 Valid Authentication Medium 2023-03-22 – 4 Stack exhaustion in MIME multipart reading with deeply nested subparts #3684603 N/A Denial of Service Medium 2026-04-29 – 4 CVE-2026-9079: stale proxy password leak #3750295 Valid Information Disclosure Medium 2026-06-24 – 4 CURLOPT_COOKIE leaked to cross-origin redirect target — CURLOPT_UNRESTRICTED_AUTH bypass for the STRING_COOKIE path #3766065 Informative Information Disclosure Medium 2026-06-05 – 4 CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples #4118610 Valid Cryptography Medium 2026-10-26 – 4 netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections) #4125043 N/A Authentication Medium 2026-10-26 – 4 CVE-2026-115528: wolfSSL TLS connect without cert #4128428 Valid Cryptography Medium 2026-10-26 – 4 POP3: data after the end-of-body terminator is written into the retrieved message #4132132 N/A Cryptography Medium 2026-10-21 – 4 Active Mixed Content over HTTPS #640532 N/A No weakness recorded Medium 2019-11-01 – 5 CVE-2021-22922: Wrong content via metalink not discarded #1213175 Valid Input Validation and Logic Medium 2021-07-21 – 5 CVE-2021-22926: CURLOPT_SSLCERT mixup with Secure Transport #1234760 Valid Input Validation and Logic Medium 2021-07-21 – 5 CVE-2022-27779: cookie for trailing dot TLD #1553301 Valid Information Disclosure Medium 2022-05-11 – 5 Credential leak on redirect #1568175 N/A Authentication Medium 2022-05-14 – 5 One Strict-Transport-Security response header empties the victim's entire HSTS store, silently, #4007917 N/A Cryptography Medium 2026-10-15 – 5 CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth #4124549 N/A Authentication Medium 2026-10-20 – 5