Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Use-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction)#3591956	Duplicate	Memory Corruption	High	2026-04-29	–	58
Negotiate connection reuse with wrong credentials when using CURLAUTH_ANY#3646072	Duplicate	Authentication	Medium	2026-04-29	–	45
Negotiate Authentication Premature on Connection Reuse#3666576	Duplicate	Authentication	High	2026-04-29	–	39
Kerberos/SPNEGO Connection Reuse Vulnerability#3725659	Duplicate	No weakness recorded	–	2026-05-14	–	22
SMTP CRLF Command Injection in CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT#3414088	Duplicate	Injection and Smuggling	Medium	2025-11-10	–	11
Heap Buffer Over-Read via Malicious SMB Server READ_ANDX Response#3470073	Duplicate	Memory Corruption	Medium	2025-12-25	–	9
Retry-independent time-condition HTTP/2 UAF#4033108	Duplicate	Memory Corruption	–	2026-10-14	–	6
IMAP custom FETCH literals can spoof tagged responses and desynchronize reused connections#4021854	Duplicate	No weakness recorded	–	2026-10-15	–	6
HTTPS proxy connection reuse lets one easy handle inherit another handle's mTLS-authenticated proxy session#3735180	Duplicate	Information Disclosure	Medium	2026-06-24	–	6
OpenSSL provider OSSL_LIB_CTX used after free via the connection shutdown list (CVE-2026-80229 fix incomplete)#4118643	Duplicate	Memory Corruption	Low	2026-10-26	–	3
20: HTAB before `Secure` attribute silently drops the Secure cookie flag#3971551	Duplicate	No weakness recorded	–	2026-10-26	–	1
14: HSTS cache import silently drops a longer-lived child beneath an includeSubDomains parent#3973124	Duplicate	Cryptography	–	2026-10-26	–	–

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.