CVE-2026-92386: server-set cookie aborts cookie jar load #4021979 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92387: never-ending loop via server response omission #4022003 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92388: FTP wildcard write callback mixup #4022070 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92389: TFTP direction confusion #4022568 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints #4023192 Valid No weakness recorded None 2026-10-14 – – Resource leak when using a normal site as DOH server #694988 Informative No weakness recorded None 2021-02-08 – 1 Parallel upload hangs curl if upload file not found #1019372 Informative Denial of Service None 2020-10-29 – 1 KRB-FTP: Security level downgrade #1590102 N/A Input Validation and Logic None 2022-06-05 – 1 CVE-2026-94265: Authorization: Negotiate sent to foreign origin #4040551 Valid No weakness recorded None 2026-10-14 – 1 CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL #4041053 Valid No weakness recorded None 2026-10-14 – 1 CVE-2026-92391: curl_mime_free stack overflow by recursion #4024222 Valid No weakness recorded None 2026-10-14 – 2 Abusing URL Parsers by long schema name #1049624 Informative Server-Side Request Forgery None 2021-01-08 – 3 Signed integer overflow in tool_progress_cb() #591770 Informative Memory Corruption None 2019-10-04 – 4 CRLF Injection in HTTP header values allows arbitrary header injection #3505557 N/A Injection and Smuggling None 2026-01-10 – 5 NULL pointer dereference in libcurl URL API redirect_url() with CURLU_DEFAULT_SCHEME #3736234 Informative Memory Corruption None 2026-05-17 – 5 Use-after-free in `curl_easy_duphandle()` with HTTP/2 stream-dependency tree #3751701 Informative Memory Corruption None 2026-06-01 – 5 CVE-2026-80230: OpenSSL pinning bypass #3969300 Valid No weakness recorded None 2026-09-03 – 6 --cert-status with OpenSSL accepts a stapled OCSP response of any age when it lacks nextUpdate (revoked certificate keeps passing) #4135826 N/A Cryptography None 2026-10-23 – 6 HTTP/2 proxy CONNECT tunnel unbounded 1xx chain (missing Curl_bump_headersize cap in cf-h2-proxy.c) #3734020 Informative Denial of Service None 2026-05-19 – 7 CVE-2026-80229: OpenSSL provider use-after-free #3969255 Valid No weakness recorded None 2026-09-03 – 7 Out-of-bounds read in curl_formadd when CURLFORM_NAMELENGTH is explicitly 0 #4024268 Informative No weakness recorded None 2026-09-15 – 7 Double free caused by mqtt_doing() #3045390 Informative Memory Corruption None 2025-06-30 – 8 Arbitrary File Read via Unsanitized curl Usage Results in Sensitive File Exposure #3183957 N/A File and Path Handling None 2025-06-27 – 8 Hash exposed in public repository #3419617 N/A Access Control None 2025-11-11 – 8 WebSocket decoder use-after-free when curl_easy_pause() unpauses from a debug callback #4123749 Informative Memory Corruption None 2026-10-19 – 8 Memory leak from doh_write_cb #3089595 Informative Denial of Service None 2025-06-29 – 9 Disclosure of email addresses #3241308 N/A Information Disclosure None 2025-07-08 – 9 SMB access smuggling via FILE URL on Windows #726117 N/A Input Validation and Logic None 2021-01-17 – 10 information disclosure #2841436 N/A No weakness recorded None 2025-07-07 – 10 curl -OJ allows creating custom .curlrc file which allows exfiltrating private data, among other things #3135673 N/A No weakness recorded None 2025-07-01 – 10 Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN match #3734921 Informative Input Validation and Logic None 2026-05-17 – 10 29: CURLOPT_ISSUERCERT accepts a different-key certificate when issuer metadata collides #3971518 Informative No weakness recorded None 2026-09-08 – 10 Curl Telnet Handler Buffer Overflow #3575475 N/A Memory Corruption None 2026-02-26 – 11 Function `do_pubkey()` can have out-of-bound read issue #3617719 N/A Memory Corruption None 2026-03-25 – 13 access notes without permission #3241304 N/A Information Disclosure None 2025-07-08 – 14 Integer Overflow/Signedness Mismatch in Printf Precision for HTTP/2 Trailer Headers #3665363 N/A Memory Corruption None 2026-04-11 – 15 CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple builds #3735179 Informative Input Validation and Logic None 2026-05-19 – 15 Secure cookies leaked to HTTP origins through HTTPS forwarding proxy #3803415 N/A Information Disclosure None 2026-06-15 – 15 Mentioned unites are at the same time .Then we have to increase the bounty. #3761789 N/A Access Control None 2026-06-01 – 17 22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal #3973143 Informative File and Path Handling None 2026-09-08 – 17 curl built with GnuTLS backend defaults to weak crypto parameters #3407352 Informative Cryptography None 2025-12-08 – 18 Use after free in hyperfifo example #3580247 Informative Memory Corruption None 2026-03-03 – 19 Memory leak of ftp (with proxy reuse) #3023139 Informative No weakness recorded None 2025-07-01 – 20 CRLF Injection via Custom HTTP Headers #3741744 N/A Injection and Smuggling None 2026-06-11 – 20 Cookie Replacement Use-After-Free Vulnerability #3516202 N/A Memory Corruption None 2026-01-19 – 21 Hi Hacker #3409186 N/A Input Validation and Logic None 2025-11-03 – 22 Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfers #3741135 N/A Access Control None 2026-05-19 – 22 Heap-buffer-overflow (Out-of-Bounds Read) in DoH hostname encoding #3324190 Informative Memory Corruption None 2025-09-04 – 24 SSTI leads to Command injection #3584149 N/A Command and Code Injection None 2026-03-04 – 25 HackerOne #3409193 N/A Memory Corruption None 2025-11-03 – 26