curl - HackerOne Reports
View on HackerOne247
Total Reports
13
Critical
47
High
82
Medium
64
Low
CVE-2024-2379: QUIC certificate check bypass with wolfSSL
Reported by:
fullmetal5
|
Disclosed:
Low
Weakness: Improper Certificate Validation
Memory leak of ftp (with proxy reuse)
Reported by:
catenacyber
|
Disclosed:
Buffer Overflow in curl MQTT Test Server (tests/server/mqttd.c) via Malicious CONNECT Packet
Reported by:
deep-hackerone
|
Disclosed:
Critical
Weakness: Memory Corruption - Generic
CVE-2021-22926: CURLOPT_SSLCERT mixup with Secure Transport
Reported by:
nyymi
|
Disclosed:
Medium
Weakness: Business Logic Errors
Bounty: $1000.00
SMB access smuggling via FILE URL on Windows
Reported by:
fms
|
Disclosed:
Weakness: Improper Input Validation
Bounty: $400.00
CVE-2024-6197: freeing stack buffer in utf8asn1str
Reported by:
z2_
|
Disclosed:
Medium
Weakness: Free of Memory not on the Heap
CRLF Injection in `--proxy-header` allows extra HTTP headers (CWE-93)
Reported by:
oblivionsage
|
Disclosed:
Weakness: CRLF Injection
Buffer overflow and affected url:-https://github.com/curl/curl/blob/master/docs/examples/hsts-preload.c
Reported by:
cyberguardianrd
|
Disclosed:
Critical
Weakness: Classic Buffer Overflow
CVE-2024-2466: TLS certificate check bypass with mbedTLS
Reported by:
frankyueh
|
Disclosed:
Medium
Weakness: Improper Validation of Certificate with Host Mismatch
CVE-2023-32001: fopen race condition
Reported by:
selmelc
|
Disclosed:
Medium
Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
Memory Leak
Reported by:
antypanty
|
Disclosed:
Weakness: Memory Corruption - Generic
Poll loop/hang on incomplete HTTP header
Reported by:
kugghjul
|
Disclosed:
Medium
Weakness: Uncontrolled Resource Consumption
Denial of Service in curl Request - HTTP headers eat all memory
Reported by:
stux3net08
|
Disclosed:
Medium
Weakness: Allocation of Resources Without Limits or Throttling
CVE-2021-22890: TLS 1.3 session ticket proxy host mixup
Reported by:
mingtao
|
Disclosed:
Low
Weakness: Man-in-the-Middle
Libcurl ocasionally sends HTTPS traffic to port 443 rather than specified port 8080
Reported by:
omdr
|
Disclosed:
Medium
Weakness: Information Disclosure
curl "globbing" can lead to denial of service attacks
Reported by:
iylz
|
Disclosed:
Low
Weakness: Uncontrolled Resource Consumption
CVE-2022-32221: POST following PUT confusion
Reported by:
robbotic
|
Disclosed:
Medium
Weakness: Expected Behavior Violation
CVE-2022-32208: FTP-KRB bad message verification
Reported by:
nyymi
|
Disclosed:
Low
Weakness: Business Logic Errors
CVE-2024-7264: ASN.1 date parser overread
Reported by:
dubek
|
Disclosed:
Low
Weakness: Buffer Over-read
WebSocket Fragmentation DoS on Curl Client
Reported by:
pelioro
|
Disclosed:
High
Weakness: Uncontrolled Resource Consumption