CVE-2021-22901: TLS session caching disaster #1180380 Valid Memory Corruption – 2021-05-26 – 76 HTTP/3 Stream Dependency Cycle Exploit #3125832 N/A Input Validation and Logic High 2025-05-04 – 60 Use-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction) #3591956 Duplicate Memory Corruption High 2026-04-29 – 58 CVE-2025-5399: WebSocket endless loop #3168039 Valid Denial of Service Low 2025-06-04 – 58 Memory Leak in libcurl via Location Header Handling (CWE-770) #3158093 Spam Denial of Service High 2025-05-22 – 55 CVE-2023-38545: socks5 heap buffer overflow #2187833 Valid Memory Corruption – 2023-10-11 – 55 CVE-2020-8177: curl overwrite local file with -J #887462 Valid Input Validation and Logic – 2020-12-05 – 55 [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames #4057637 Informative File and Path Handling High 2026-09-26 – 54 CVE-2025-5025: No QUIC certificate pinning with wolfSSL #3153497 Valid Cryptography Medium 2025-05-28 – 54 Buffer overflow in strcpy #2823554 N/A Memory Corruption Critical 2024-11-07 – 53 CVE-2024-7264: ASN.1 date parser overread #2629968 Valid Memory Corruption Low 2024-08-01 – 53 CVE-2020-8286: Inferior OCSP verification #1048457 Valid Cryptography – 2020-12-09 – 51 CVE-2024-9681: HSTS subdomain overwrites parent cache entry #2764830 Valid Input Validation and Logic Low 2024-11-06 – 49 Hackers Attack Curl Vulnerability Accessing Sensitive Information #2912277 N/A Information Disclosure Medium 2024-12-27 – 48 Integer Underflow in src/var.c #3523349 N/A Memory Corruption Medium 2026-01-26 – 46 Negotiate connection reuse with wrong credentials when using CURLAUTH_ANY #3646072 Duplicate Authentication Medium 2026-04-29 – 45 MQTT Protocol Packet Injection via Unchecked CONNACK Remaining Length #3531216 Informative No weakness recorded Low 2026-02-05 – 45 `Curl_socketpair()` fallback vulnerable to man-in-the-middle attack #3148937 Informative Cryptography – 2025-05-20 – 45 Buffer Overflow Vulnerability in strcpy() Leading to Remote Code Execution #2871792 N/A Memory Corruption Critical 2024-12-02 – 45 Security check up #3269761 N/A Denial of Service Low 2025-07-24 – 44 wcurl Argument Injection via Unquoted Variable #3523953 N/A Command and Code Injection Medium 2026-01-26 – 43 CVE-2025-10966: missing SFTP host verification with wolfSSH #3355218 Valid Cryptography Low 2025-11-05 – 43 CVE-2025-4947: QUIC certificate check skip with wolfSSL #3150884 Valid Cryptography Medium 2025-05-28 – 43 curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download write #3747959 N/A Race Conditions Medium 2026-05-20 – 42 mbedTLS private-key blob null-termination asymmetry in lib/vtls/mbedtls.c (mbed_load_privkey) #3717365 Informative Memory Corruption – 2026-05-07 – 42 CRLF Injection in `--proxy-header` allows extra HTTP headers (CWE-93) #3133379 N/A Injection and Smuggling None 2025-05-08 – 42 Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c #3211973 Informative Information Disclosure Low 2025-06-22 – 41 Windows SSPI connection-pool probe can reuse a connection under the wrong user #3938185 N/A Authentication Medium 2026-08-14 – 39 HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiB #3734947 N/A Denial of Service – 2026-05-19 – 39 Negotiate Authentication Premature on Connection Reuse #3666576 Duplicate Authentication High 2026-04-29 – 39 Buffer Overflow Risk in Curl_inet_ntop and inet_ntop4 #2887487 N/A Memory Corruption High 2024-12-08 – 39 urlapi: off-by-one in custom scheme validation skips last character #3598358 Informative Memory Corruption High 2026-03-12 – 38 Buffer Overflow Vulnerability in WebSocket Handling #2298307 N/A Memory Corruption – 2024-01-02 – 38 curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session Hijacking #3917775 N/A Cryptography – 2026-08-05 – 37 CVE-2026-7168: cross-proxy Digest auth state leak #3697719 Valid Information Disclosure Medium 2026-04-29 – 37 Bypassing Strict SSH Server Verification via Connection Pool Reuse in libcurl #3639277 Informative No weakness recorded – 2026-03-31 – 37 testing hackerone functions #3463619 Spam Authentication None 2025-12-13 – 37 MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstate #3702718 Informative Input Validation and Logic Medium 2026-04-29 – 36 Integer Overflow in curl_multi_get_handles() Leading to Heap Buffer Overflow #3575245 N/A Memory Corruption Medium 2026-02-26 – 36 CVE-2025-9086: Out of bounds read for cookie path #3294999 Valid Memory Corruption Low 2025-09-10 – 36 Sensitive information disclosure with malicious netrc file #3211126 Informative Information Disclosure Medium 2025-06-22 – 36 CVE-2025-0167: netrc and default credential leak #2917232 Valid Information Disclosure Low 2025-02-07 – 36 CVE-2024-8096: OCSP stapling bypass with GnuTLS #2669852 Valid Cryptography Medium 2024-09-11 – 36 Windows filename sanitizer misses Unicode COM/LPT reserved device names #4040799 Informative No weakness recorded None 2026-09-24 – 35 Credentials forwarded to HTTP after HTTPS→HTTP same-port redirect — url_set_data_creds uses scheme-blind comparator #3733946 Informative No weakness recorded None 2026-05-20 – 35 CVE-2026-3805: use after free in SMB connection reuse #3591944 Valid Memory Corruption Medium 2026-03-11 – 34 Unsanitized IPFS CID Allows SSRF Against Configured Gateway #3366484 N/A Server-Side Request Forgery Medium 2025-10-03 – 34 CVE-2024-6197: freeing stack buffer in utf8asn1str #2559516 Valid Memory Corruption Medium 2024-07-24 – 34 CVE-2026-7009: OCSP stapling bypass with Apple SecTrust #3694390 Valid Cryptography Medium 2026-04-29 – 33 on the implications of permitting procedural culling #3262848 N/A Cryptography Low 2025-07-22 – 33