Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

curl — Vulnerabilities & Security Advisories 122

All 122 CVE vulnerabilities found in curl, with AI-generated Chinese analysis, references, and POCs.

This page documents Common Weakness Enumeration vulnerabilities associated with the curl product developed by Daniel Stenberg and the community. It aggregates security flaw data to provide a comprehensive view of the software’s historical and current risk landscape. The content collects vulnerability reports spanning from the initial public releases of curl up to the most recent updates, ensuring a complete chronological record of security issues. Users can discover detailed information by tracking vendor advisories, understanding specific weakness classes such as buffer overflows or use-after-free errors, and examining the full vulnerability history of the product. This resource is designed for security researchers, developers, and system administrators who need to assess the impact of known flaws on their deployments. By centralizing this data, the page facilitates better risk management and informed decision-making regarding updates and mitigations. The aggregation process relies on official advisories, CVE entries, and community-reported issues to maintain accuracy and completeness. Readers are encouraged to use the available tools to filter results by date, severity, or specific weakness types. This approach supports proactive security practices by highlighting patterns in vulnerability discovery and resolution for the curl ecosystem.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-3784 wrong proxy connection reuse with credentials CWE-305 7.5 - 2026-03-11
CVE-2026-3783 token leak with redirect and netrc CWE-522 6.5 - 2026-03-11
CVE-2026-1965 bad reuse of HTTP Negotiate connection CWE-305 7.7 - 2026-03-11
CVE-2025-11563 wcurl path traversal with percent-encoded slashes 9.1AI Critical AI 2026-02-25
CVE-2025-15224 libssh key passphrase bypass without agent set CWE-287 9.8 - 2026-01-08
CVE-2025-15079 libssh global known_hosts override CWE-297 7.5 - 2026-01-08
CVE-2025-14819 OpenSSL partial chain store policy bypass CWE-295 8.2 - 2026-01-08
CVE-2025-14524 bearer token leak on cross-protocol redirect CWE-522 4.3 - 2026-01-08
CVE-2025-14017 broken TLS options for threaded LDAPS CWE-567 4.3 - 2026-01-08
CVE-2025-13034 No QUIC certificate pinning with GnuTLS CWE-295 7.5 - 2026-01-08
CVE-2025-10966 missing SFTP host verification with wolfSSH CWE-322 7.4 - 2025-11-07
CVE-2025-10148 predictable WebSocket mask CWE-340 7.1 - 2025-09-12
CVE-2025-9086 Out of bounds read for cookie path CWE-125 8.1 - 2025-09-12
CVE-2025-5399 WebSocket endless loop 7.5AI High AI 2025-06-07
CVE-2025-5025 No QUIC certificate pinning with wolfSSL 6.5AI Medium AI 2025-05-28
CVE-2025-4947 QUIC certificate check skip with wolfSSL 7.4AI High AI 2025-05-28
CVE-2025-0725 gzip integer overflow 8.8 - 2025-02-05
CVE-2025-0665 eventfd double close 7.1 - 2025-02-05
CVE-2025-0167 netrc and default credential leak 5.9 - 2025-02-05
CVE-2024-11053 netrc and redirect credential leak 6.5 - 2024-12-11
CVE-2024-9681 HSTS subdomain overwrites parent cache entry 5.9AI Medium AI 2024-11-06
CVE-2024-8096 OCSP stapling bypass with GnuTLS 7.5AI High AI 2024-09-11
CVE-2024-7264 ASN.1 date parser overread 9.1AI Critical AI 2024-07-31
CVE-2024-6874 macidn punycode buffer overread 9.1AI Critical AI 2024-07-24
CVE-2024-6197 freeing stack buffer in utf8asn1str 9.1AI Critical AI 2024-07-24
CVE-2024-2466 TLS certificate check bypass with mbedTLS 5.9 - 2024-03-27
CVE-2024-2379 QUIC certificate check bypass with wolfSSL 7.5 - 2024-03-27
CVE-2024-2398 HTTP/2 push headers memory-leak - - 2024-03-27
CVE-2024-2004 Usage of disabled protocol 7.5 - 2024-03-27
CVE-2024-0853 OCSP verification bypass with TLS session reuse 9.1 - 2024-02-03

All 122 known CVE vulnerabilities affecting curl with full Chinese analysis, references, and POCs where available.