Daniel Stenberg

A remote HTTP server can cause `curl` to write a record to a Netscape cookie jar that exceeds the line-length parsing limit by providing a long cookie name and value. When a subsequent `curl` invocation attempts to read from this cookie jar using the `--cookie` flag, the parsing process silently aborts upon encountering the oversized line, causing all following valid cookies in the file to be ignored.

libcurl may accidentally return a URL containing credentials when the `CURLINFO EFFECTIVE URL` option is used with the `curl easy getinfo()` function, even if the original URL or the redirected URL did not contain them. This occurs when curl retrieves credentials from a `.netrc` file. The curl command line tool is also affected via the `--write-out '%{url effective}'` option.

A logic flaw in the curl command line tool prevents SSH host verification options from being applied when a connection is established via a redirect. Specifically, if the initial request is HTTPS and the server returns a `Location: sftp://example.com` redirect while using `--location` and `--proto-redir +sftp`, the subsequent SFTP connection ignores the user's requested verification methods. This affects the application of the `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` options.

A deeply nested multipart MIME structure created through the public API causes a stack overflow in libcurl during cleanup. This occurs because the `curl mime free()` function uses excessive recursion depth when traversing the structure, leading to unbounded stack frame allocation and crashing the host process.

A remote HTTP server can set a cookie that is accepted and written to a Netscape cookie jar but cannot be reloaded. When curl is subsequently invoked using the same path for the `--cookie` and `--cookie-jar` parameters, the application fails before establishing a connection. During the cleanup procedure, curl replaces the cookie jar with an empty file, which results in the deletion of cookies for unrelated domains.

The TFTP state machine fails to validate state transitions against the requested transfer direction, allowing opening server responses for reads and writes to be accepted interchangeably. A malicious TFTP server can respond to a download request to force the client into transmit mode. This causes libcurl to consume and transmit data from the handle's persistent `CURLOPT READDATA` pointer, which may include data remaining from unrelated prior operations, such as an HTTP POST request performed on a reused handle.

A malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl by permanently omitting the final control-response line. This action allows the server to completely bypass the configured transfer timeout mechanism, resulting in an indefinite block of all concurrent transfers associated with the same multi-handle.

An authenticated HTTPS origin can provide an HSTS `max-age` value that is accepted by the parser but fails during subsequent time serialization. On 64-bit systems, extreme `max-age` values can result in an absolute expiry that exceeds calendar time structure bounds while remaining within standard time integer limits. During the cache saving process, the original HSTS file is truncated before a temporary replacement is written. If serialization fails, the temporary file is deleted, resulting in an empty or partial cache. This data loss occurs silently, and the application exits successfully without indicating an error.

An issue exists during the HSTS cache import process where importing a parent HSTS entry with the `includeSubDomains` flag before a longer-lived child entry causes the child entry to be silently dropped. When the parent entry eventually expires, the valid HSTS policy for the child is lost, which leads the software to issue unencrypted HTTP requests instead of upgrading them to HTTPS.

A failure during an FTP wildcard `LIST` operation prevents the restoration of the write callback, leaving it set to the internal listing parser and the write callback data pointing to the easy handle. Reusing this handle can cause an immediate crash. Cloning the handle via `curl easy duphandle()` propagates this corrupted state. If the original handle is freed, using the cloned handle leads to a heap use-after-free read. Additionally, reusing the original or cloned handle while updating only `CURLOPT WRITEDATA` without updating `CURLOPT WRITEFUNCTION` causes type confusion, where the internal parser writes server response bytes into the memory location specified by the application-supplied write data pointer.

A flaw exists in the handling of HTTP/2 Server Push streams. When the parent handle is configured to share connections with other handles, a use-after-free condition can occur during the cleanup process. Use-after-free is a memory corruption issue where an application continues to use a pointer after it has been freed.

A heap-use-after-free occurs when using libcurl's multi interface with OpenSSL 3 provider configurations. The issue arises because libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference. If the easy handle is destroyed prematurely, the context is freed while the active connection retains a dangling pointer, which can be triggered during subsequent I/O or post-handshake operations.

A flaw exists where using a horizontal tab (ASCII code 9) instead of a space (ASCII code 32) immediately before the `Secure` attribute in a `Set-Cookie:` header causes the software to store the cookie without the Secure flag. This may result in the cookie being transmitted over plaintext HTTP during subsequent requests to the same host.

When libpsl support is enabled, the software fails to enforce the Public Suffix List boundary check while processing a `Set-Cookie` header. This occurs when the `Domain` attribute explicitly matches an origin host that is a public suffix, such as `co.uk`. Instead of treating it as a strict host-only cookie, the system saves it with a wildcard domain scope (`.co.uk`). This leads to the cookie being incorrectly included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix, such as `attacker.co.uk`.

An issue exists where libcurl fails to enforce public key pinning when `CURLOPT PINNEDPUBLICKEY` is used in conjunction with options that disable standard peer verification, specifically `CURLOPT SSL VERIFYPEER = 0` and `CURLOPT SSL VERIFYHOST = 0`. This allows unauthenticated connections to succeed without a presented server certificate, bypassing the pinning check.

A flaw in libcurl causes the software to incorrectly reuse an existing HTTPS connection setup for a specific hostname, even if a different Native CA Store setting (`CURLSSLOPT NATIVE CA`) is used compared to when the connection was originally established. The Native CA Store is a mechanism that allows curl to use the operating system's built-in certificate store to verify the authenticity of SSL/TLS certificates.

An issue exists where the HTTP `Referer:` header persists even after being explicitly cleared. Although passing NULL to `CURLOPT REFERER` is intended to suppress the header, the internal state is not cleared. This causes the previous referrer string to be reused and sent in subsequent requests, which may lead to the leakage of sensitive information to unintended servers.

A use-after-free issue occurs when the `curl easy pause()` function is called within the event-based `CURLMOPT SOCKETFUNCTION` callback. This leads to a situation where libcurl attempts to store a flag using a dangling struct pointer immediately after the memory associated with that pointer has been freed.

A disconnect between the tool layer and libcurl occurs when a user invokes curl with a schemeless URL and the `--proto-default` option set to sftp or scp. The tool layer incorrectly infers the URL scheme, which bypasses the initialization of critical SSH security options, specifically `CURLOPT SSH HOST PUBLIC KEY SHA256` and `CURLOPT SSH KNOWNHOSTS`. While the libcurl runtime still establishes the connection via SFTP or SCP, the omission of these host verification options allows curl to connect to an unverified SSH remote host without triggering an error.

When reusing a handle for sequential transfers driven by environment-variable proxy configuration, the software fails to clear the proxy authentication state between requests. If an initial transfer authenticates against a proxy using Digest authentication, a subsequent transfer routed through a different proxy erroneously leaks the `Proxy-Authorization:` header intended for the first proxy.