CVE-2021-22901: TLS session caching disaster Analysed #1180380 Valid Memory Corruption High 2021-05-26 – 76 CVE-2025-5399: WebSocket endless loop Analysed #3168039 Valid Denial of Service Low 2025-06-04 – 58 CVE-2023-38545: socks5 heap buffer overflow #2187833 Valid Memory Corruption High 2023-10-11 – 55 CVE-2020-8177: curl overwrite local file with -J #887462 Valid Input Validation and Logic Medium 2020-12-05 – 55 CVE-2025-5025: No QUIC certificate pinning with wolfSSL #3153497 Valid Cryptography Medium 2025-05-28 – 54 CVE-2024-7264: ASN.1 date parser overread #2629968 Valid Memory Corruption Low 2024-08-01 – 53 CVE-2020-8286: Inferior OCSP verification #1048457 Valid Cryptography Medium 2020-12-09 – 51 CVE-2024-9681: HSTS subdomain overwrites parent cache entry #2764830 Valid Input Validation and Logic Low 2024-11-06 – 49 CVE-2025-10966: missing SFTP host verification with wolfSSH #3355218 Valid Cryptography Low 2025-11-05 – 43 CVE-2025-4947: QUIC certificate check skip with wolfSSL #3150884 Valid Cryptography Medium 2025-05-28 – 43 CVE-2026-7168: cross-proxy Digest auth state leak #3697719 Valid Information Disclosure Medium 2026-04-29 – 37 CVE-2025-9086: Out of bounds read for cookie path #3294999 Valid Memory Corruption Low 2025-09-10 – 36 CVE-2025-0167: netrc and default credential leak #2917232 Valid Information Disclosure Low 2025-02-07 – 36 CVE-2024-8096: OCSP stapling bypass with GnuTLS #2669852 Valid Cryptography Medium 2024-09-11 – 36 CVE-2026-3805: use after free in SMB connection reuse #3591944 Valid Memory Corruption Medium 2026-03-11 – 34 CVE-2024-6197: freeing stack buffer in utf8asn1str #2559516 Valid Memory Corruption Medium 2024-07-24 – 34 CVE-2026-7009: OCSP stapling bypass with Apple SecTrust #3694390 Valid Cryptography Medium 2026-04-29 – 33 CVE-2024-11053: netrc + redirect credential leak #2829063 Valid Information Disclosure Low 2024-12-11 – 33 CVE-2024-2004: Usage of disabled protocol #2384833 Valid Input Validation and Logic Low 2024-03-27 – 33 CVE-2026-3784: wrong proxy connection reuse with credentials #3584903 Valid Access Control Low 2026-03-11 – 30 CVE-2025-10148: predictable WebSocket mask #3330839 Valid Cryptography Low 2025-09-10 – 30 CVE-2020-8284: trusting FTP PASV responses #1040166 Valid Information Disclosure Low 2021-02-09 – 30 CVE-2023-46218: cookie mixed case PSL bypass #2212193 Valid Information Disclosure Medium 2023-12-06 – 28 CVE-2023-46219: HSTS long file name clears contents #2236133 Valid Cryptography Low 2023-12-08 – 27 CVE-2026-3783: token leak with redirect and netrc #3583983 Valid Information Disclosure Medium 2026-03-11 – 26 CVE-2023-32001: fopen race condition #2039870 Valid Race Conditions Medium 2023-07-25 – 26 CVE-2024-6874: macidn punycode buffer overread #2604391 Valid Memory Corruption Low 2024-07-24 – 25 CVE-2019-5443: Windows Privilege Escalation: Malicious OpenSSL Engine #608577 Valid Command and Code Injection High 2019-06-29 – 25 CVE-2026-6276: stale custom cookie host causes cookie leak #3671818 Valid Information Disclosure Low 2026-04-29 – 24 CVE-2026-6253: proxy credentials leak over redirect-to proxy #3669637 Valid No weakness recorded Medium 2026-04-29 – 24 CVE-2025-0665: eventfd double close #2954286 Valid Race Conditions Low 2025-02-07 – 24 CVE-2019-5435: An integer overflow found in /lib/urlapi.c #547630 Valid Memory Corruption Low 2020-12-05 – 24 CVE-2024-0853: OCSP verification bypass with TLS session reuse #2298922 Valid Cryptography Low 2024-01-31 – 23 CVE-2026-80256: wcurl backslash bypass #3969820 Valid File and Path Handling Medium 2026-09-02 – 22 CVE-2026-5545: wrong reuse of HTTP Negotiate connection #3642555 Valid Authentication Medium 2026-04-29 – 22 CVE-2020-8169: Partial password leak over DNS on HTTP redirect #874778 Valid Information Disclosure Medium 2020-12-05 – 21 CVE-2023-28319: UAF in SSH sha256 fingerprint check #1913733 Valid Memory Corruption Medium 2023-05-24 – 20 CVE-2026-6429: netrc credential leak with reused proxy connection #3677759 Valid Information Disclosure Medium 2026-04-29 – 19 CVE-2022-27776: Auth/cookie leak on redirect #1547048 Valid Authentication Medium 2022-04-27 – 19 CVE-2025-15079: libssh global knownhost override #3477116 Valid Cryptography Low 2026-01-07 – 18 CVE-2025-14524: bearer token leak on cross-protocol redirect #3459417 Valid Authentication Low 2026-01-07 – 17 CVE-2025-0725: gzip integer overflow #2956023 Valid Memory Corruption Low 2025-02-05 – 17 CVE-2024-2466: TLS certificate check bypass with mbedTLS #2416725 Valid Cryptography Medium 2024-03-27 – 17 CVE-2023-23916: HTTP multi-header compression denial of service #1826048 Valid Denial of Service Medium 2023-02-20 – 16 CVE-2022-43552: HTTP Proxy deny use-after-free #1764858 Valid Memory Corruption Low 2022-12-26 – 16 CVE-2019-5436: Heap Buffer Overflow at lib/tftp.c #550696 Valid Memory Corruption Low 2019-05-31 – 16 CVE-2026-82209: domain-scoped PSL domain cookie #3972385 Valid Information Disclosure – 2026-09-03 – 15 CVE-2026-18924: HTTP/2 server push UAF #3916059 Valid Memory Corruption Low 2026-09-02 – 14 CVE-2026-5773: wrong reuse of SMB connection #3650689 Valid No weakness recorded Low 2026-04-29 – 14 CVE-2021-22945: UAF and double-free in MQTT sending #1269242 Valid Memory Corruption Medium 2021-09-15 – 14