CVE-2024-11053: netrc + redirect credential leak Analysed #2829063 Valid Information Disclosure Low 2024-12-11 – 33 CVE-2024-2004: Usage of disabled protocol Analysed #2384833 Valid Input Validation and Logic Low 2024-03-27 – 33 Exposed .git/config File Leading to Potential Sensitive Information Disclosure #3612891 N/A No weakness recorded Low 2026-03-20 – 32 A quiet New Year wish for security researchers #3483225 Spam No weakness recorded None 2026-01-01 – 32 Missing Security Headers #3310318 N/A No weakness recorded Medium 2025-08-22 – 32 WebSocket Fragmentation DoS on Curl Client #3303765 N/A Denial of Service High 2025-08-19 – 32 Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts #3952619 Informative Information Disclosure – 2026-08-21 – 31 MQTT CONNACK Packet Type Bypass leads to RCE via Malicious Broker #3712343 Informative Command and Code Injection Critical 2026-05-05 – 31 SSL options ISSUERCERT, EC_CURVES and CRLFILE silently ignored by non-OpenSSL backends #3516974 N/A Cryptography Medium 2026-01-20 – 31 Arbitrary File Read via file:// Protocol in cURL #3242087 N/A File and Path Handling Critical 2025-07-09 – 31 curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack #3955945 N/A Race Conditions Critical 2026-08-26 – 30 Vulnerability Report: Buffer Overflow in Path Sanitization #3804525 N/A No weakness recorded Critical 2026-06-16 – 30 SSH/SFTP connection reuse can bypass SSH key identity after ssh_config_matches removal #3788506 Informative Authentication High 2026-06-09 – 30 Schannel custom-CA path skips Extended Key Usage enforcement #3734992 Informative Input Validation and Logic – 2026-05-19 – 30 lib/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a) #3674275 Informative Authentication Medium 2026-04-16 – 30 HTTP/1.1 Response Desynchronization via conflicting CL/TE headers in Proxy CONNECT #3623064 Informative Injection and Smuggling Low 2026-03-25 – 30 SMB READ_ANDX DataOffset not validated #3603300 N/A No weakness recorded High 2026-03-16 – 30 CVE-2026-3784: wrong proxy connection reuse with credentials Analysed #3584903 Valid Access Control Low 2026-03-11 – 30 Cross‑origin cookies leak and injection risk when using a custom Host header #3516878 N/A Authentication – 2026-01-20 – 30 Apple SecTrust legacy path accepts untrusted certificates on pre-10.14 macOS/iOS when built with USE_APPLE_SECTRUST #3374554 Informative Cryptography High 2025-10-09 – 30 OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients) #3373640 Informative Denial of Service Low 2025-10-08 – 30 CVE-2025-10148: predictable WebSocket mask Analysed #3330839 Valid Cryptography Low 2025-09-10 – 30 libcurl: Host-Only Cookies Leak to Alternate IPv4 Forms #3324901 N/A No weakness recorded – 2025-09-04 – 30 Use After Free (that leads to arbitrary Write for some versions) #3283232 Informative Memory Corruption – 2025-08-06 – 30 Use-After-Free in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurl #3242005 N/A Memory Corruption High 2025-07-09 – 30 bypass of this Fixed #2437131 [ Inadequate Protocol Restriction Enforcement in curl ] #2905552 N/A Cryptography Low 2024-12-19 – 30 cookie is sent on redirect #2352676 N/A Authentication Medium 2024-03-28 – 30 CVE-2020-8284: trusting FTP PASV responses Analysed #1040166 Valid Information Disclosure Low 2021-02-09 – 30 Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade #4064040 N/A Information Disclosure High 2026-10-05 – 29 libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms #3680680 Informative Information Disclosure Medium 2026-04-19 – 29 Internal application wrapper or script using curl #3648199 N/A Command and Code Injection Critical 2026-04-03 – 29 Heap‑based buffer overflow in curl -K <config_file> allows arbitrary write . #3094406 Informative Memory Corruption High 2025-04-27 – 29 ("possible") UAF #2981245 N/A Memory Corruption None 2025-02-08 – 29 Curl_compareheader() fails to match multi-value HTTP headers #3598444 Informative Input Validation and Logic Medium 2026-03-12 – 28 RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload) #3575250 Informative Input Validation and Logic None 2026-02-26 – 28 Cookie Max-Age Integer Overflow Vulnerability #3516186 N/A Memory Corruption Critical 2026-01-19 – 28 Out-of-bounds read in HTTP method handling causes undefined behavior and potential crash This is sharp, Gaurav. We’ve got a real memory-safety bug ins #3434510 N/A Memory Corruption High 2025-11-20 – 28 Timing Attack Vulnerability in curl Digest Authentication via Non-Constant-Time String Comparison #3346118 N/A Information Disclosure Medium 2025-09-18 – 28 curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/Tor #3306475 N/A Information Disclosure – 2025-08-20 – 28 Integer Overflow in schannel.c TLS Data Transmission #3282709 N/A Memory Corruption Medium 2025-08-02 – 28 Memory Leak #3137657 Informative Memory Corruption – 2025-05-10 – 28 CVE-2023-46218: cookie mixed case PSL bypass Analysed #2212193 Valid Information Disclosure Medium 2023-12-06 – 28 URL API: triple-slash parses path segment as hostname #3923212 N/A Input Validation and Logic Medium 2026-08-07 – 27 Heap-OOB read in urlapi `redirect_url()` via `CURLU_GUESS_SCHEME` + `CURLU_NO_GUESS_SCHEME` flow #3751715 Informative Memory Corruption – 2026-05-25 – 27 AWS SigV4 Signature Disclosure via Verbose Logging in libcurl #3361913 N/A Information Disclosure – 2025-10-01 – 27 SMTP Command Injection Vulnerabilities in curl #3357960 N/A Command and Code Injection – 2025-09-26 – 27 Stack use-after-scope in HTTP/3 POST request processing via CURLOPT_POSTFIELDS #3279804 N/A Memory Corruption High 2025-07-31 – 27 Double Free Vulnerability in `libcurl` Cookie Management (`cookie.c`) #3117697 N/A Memory Corruption – 2025-04-29 – 27 CVE-2023-46219: HSTS long file name clears contents Analysed #2236133 Valid Cryptography Low 2023-12-08 – 27 HTTP/1.1 response framing violation and unsafe connection reuse when transfer decoding is disabled #4025056 Informative Injection and Smuggling Medium 2026-09-19 – 26