Daniel Stenberg

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A flaw exists in the handling of HTTP/2 Server Push streams. When the parent handle is configured to share connections with other handles, a use-after-free condition can occur during the cleanup process. Use-after-free is a memory corruption issue where an application continues to use a pointer after it has been freed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When libpsl support is enabled, the software fails to enforce the Public Suffix List boundary check while processing a `Set-Cookie` header. This occurs when the `Domain` attribute explicitly matches an origin host that is a public suffix, such as `co.uk`. Instead of treating it as a strict host-only cookie, the system saves it with a wildcard domain scope (`.co.uk`). This leads to the cookie being incorrectly included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix, such as `attacker.co.uk`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** A flaw exists where using a horizontal tab (ASCII code 9) instead of a space (ASCII code 32) immediately before the `Secure` attribute in a `Set-Cookie:` header causes the software to store the cookie without the Secure flag. This may result in the cookie being transmitted over plaintext HTTP during subsequent requests to the same host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** A flaw in libcurl causes the software to incorrectly reuse an existing HTTPS connection setup for a specific hostname, even if a different Native CA Store setting (`CURLSSLOPT NATIVE CA`) is used compared to when the connection was originally established. The Native CA Store is a mechanism that allows curl to use the operating system's built-in certificate store to verify the authenticity of SSL/TLS certificates. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** An issue exists where libcurl fails to enforce public key pinning when `CURLOPT PINNEDPUBLICKEY` is used in conjunction with options that disable standard peer verification, specifically `CURLOPT SSL VERIFYPEER = 0` and `CURLOPT SSL VERIFYHOST = 0`. This allows unauthenticated connections to succeed without a presented server certificate, bypassing the pinning check. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** A heap-use-after-free occurs when using libcurl's multi interface with OpenSSL 3 provider configurations. The issue arises because libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference. If the easy handle is destroyed prematurely, the context is freed while the active connection retains a dangling pointer, which can be triggered during subsequent I/O or post-handshake operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A flaw exists where the software fails to clear proxy authentication credentials when instructed to do so. This results in old credentials remaining available and potentially being used for subsequent transfers that should not have access to them. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** An issue exists where the HTTP `Referer:` header persists even after being explicitly cleared. Although passing NULL to `CURLOPT REFERER` is intended to suppress the header, the internal state is not cleared. This causes the previous referrer string to be reused and sent in subsequent requests, which may lead to the leakage of sensitive information to unintended servers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A use-after-free issue occurs when the `curl easy pause()` function is called within the event-based `CURLMOPT SOCKETFUNCTION` callback. This leads to a situation where libcurl attempts to store a flag using a dangling struct pointer immediately after the memory associated with that pointer has been freed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** When reusing a handle for sequential transfers driven by environment-variable proxy configuration, the software fails to clear the proxy authentication state between requests. If an initial transfer authenticates against a proxy using Digest authentication, a subsequent transfer routed through a different proxy erroneously leaks the `Proxy-Authorization:` header intended for the first proxy. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** A flaw in the cookie parsing logic allows a malicious HTTP server to set super cookies that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that are subsequently scoped and transmitted to unrelated third-party domains. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** A disconnect between the tool layer and libcurl occurs when a user invokes curl with a schemeless URL and the `--proto-default` option set to sftp or scp. The tool layer incorrectly infers the URL scheme, which bypasses the initialization of critical SSH security options, specifically `CURLOPT SSH HOST PUBLIC KEY SHA256` and `CURLOPT SSH KNOWNHOSTS`. While the libcurl runtime still establishes the connection via SFTP or SCP, the omission of these host verification options allows curl to connect to an unverified SSH remote host without triggering an error. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** When performing a transfer to a specific HTTP origin (`hostA`) using Digest authentication and subsequently changing the origin to a different one (`hostB`) while reusing the same handle, libcurl incorrectly forwards the `Authorization:` header intended for `hostA` to `hostB`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A logical error in the connection pooling mechanism may cause libcurl to reuse an incorrect connection for SMB(S) transfers. When reusing a connection, specific criteria must be met; however, a request could wrongfully reuse an existing SMB connection to the same server that utilized a different share than the subsequent transfer requires. This may result in downloading the wrong file or uploading a file to an incorrect location, provided the same credentials and server name are used. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When using libcurl to perform a transfer over a specific HTTP proxy (`proxyA`) with Digest authentication and subsequently changing the proxy host to a second one (`proxyB`) while reusing the same handle, libcurl incorrectly sends the `Proxy-Authorization:` header intended for `proxyA` to `proxyB`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** A flaw exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is performed in clear-text via IMAP, SMTP, or POP3, a subsequent request to the same host bypasses the TLS requirement and transmits data unencrypted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** When configured to use a `.netrc` file for credentials and to follow HTTP redirects, libcurl may leak the password used for the initial host to the subsequent host during the redirect process under certain circumstances. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When using libcurl, a flaw exists where a custom `Host:` header set for an initial HTTP request can cause subsequent requests using the same easy handle to use stale information. If the second request is made without a custom `Host:` header, it may leak cookies intended for the first host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** curl may erroneously pass credentials intended for a first proxy to a second proxy. This occurs when curl is configured to use different proxies for different URL schemes, the first proxy requires credentials, the second proxy does not, and curl is redirected from a URL using the first proxy's scheme (e.g., `http://`) to a URL using a different scheme (e.g., `https://`) that utilizes the second proxy. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under certain circumstances. Specifically, if the hostname that the first request is redirected to has information in the used .netrc file, with either the `machine` or `default` keywords, curl would pass on the bearer token set for the first host to the second one. The .netrc file stores credentials, and this issue could expose sensitive tokens. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.