Stefan Eissing

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A flaw exists where the software incorrectly reuses an HTTP connection setup for a specific hostname when using Negotiate authentication, specifically when the initial request is made with empty credentials. This behavior can lead to a situation where a request from one user is transmitted over a connection previously authenticated by another user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** When using the wolfSSL backend with CA caching enabled, a flaw exists where the `CURLOPT SSL CTX FUNCTION` callback can be overridden. If this callback replaces the trust store, libcurl may silently reinstall the cached store after the callback returns. This results in a scenario where a certificate trusted by the cached store is incorrectly accepted, even if it was rejected by the store selected via the callback. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** An issue exists where libcurl may send request data on a new connection before enforcing certificate verification failure. This occurs when a user first connects to a legitimate HTTP/3 server and subsequently connects to an attacker's impostor machine lacking a valid certificate. The leak of sensitive information can happen if a cached SSL session is used (where `CURLOPT SSL SESSIONID CACHE` is enabled) and early data is active (where the `CURLSSLOPT EARLYDATA` bit is set in `CURLOPT SSL OPTIONS`). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable the `CURLOPT SSL SESSIONID CACHE` option. Disable the `CURLSSLOPT EARLYDATA` bit within `CURLOPT SSL OPTIONS`.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw exists where a new transfer utilizing STARTTLS to upgrade the connection may incorrectly reuse an existing live connection despite a mismatch in the TLS configuration. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When configured to use a `.netrc` file for credentials while simultaneously specifying a URL containing a username but no password (e.g., `https://user@example.com/`), the software may incorrectly retrieve and use the password of a different user defined in the `.netrc` file for that host, provided no match for the specified user exists. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A logical error in the connection pooling mechanism allows the software to reuse an incorrect connection for Negotiate-authenticated requests. This occurs even when the requests are configured to use different services, potentially leading to a request being sent over a connection authenticated for a different service on the same server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** The WebSocket component of the libcurl library contains a resource allocation issue. By default, curl automatically responds to WebSocket PING frames. Because the software lacks an upper bound on memory allocation for unacknowledged frames, a remote attacker acting as a malicious server can exhaust all available memory by flooding the client with rapid, sequential PING messages, resulting in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** An issue exists in the certificate authentication procedure where the library maintains a connection pool for reusing connections in subsequent transfers. If a handle initially uses the default native CA trust and is later switched to custom CA material, it may continue to trust the native platform store for subsequent transfers using that handle. This could allow a remote attacker to perform data spoofing or gain unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cURL (affected versions not specified) libcurl (affected versions not specified) **Description** An issue in the QUIC UDP receive function allows a remote malicious HTTP/3 server to cause a denial of service. The helper function fails to count zero-length UDP datagrams toward the per-call packet budget before discarding them, enabling a connected QUIC peer to stream empty datagrams and indefinitely stall the client. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A use-after-free issue exists in libcurl involving the HTTP/2 stream-dependency tree management. This occurs when an application configures the tree using `CURLOPT STREAM DEPENDS` or `CURLOPT STREAM DEPENDS E`, calls the `curl easy reset()` function, and then terminates the handle via the `curl easy cleanup()` function. During the final cleanup, the library attempts to access and modify an internal structure that was already freed during the reset operation. This flaw may allow a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A logical error in the connection pooling mechanism allows libcurl to reuse an incorrect connection during authenticated HTTP(S) requests to the same host. If an application first performs a request using Negotiate authentication with one set of credentials and subsequently attempts another request to the same server with different credentials while the initial connection is still active, the second request may wrongly reuse the existing connection. This results in the second request being sent over a connection still authenticated with the first user's credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When using the Certificate Status Request TLS extension, commonly known as OCSP stapling, to verify server certificate validity, the software fails to detect OCSP problems and incorrectly treats the response as valid. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** The software is susceptible to a use-after-free issue when handling SMB connection reuse. Specifically, when a second SMB request is made to the same host, the software incorrectly utilizes a data pointer that has already been freed from memory. This can lead to unpredictable behavior and potential security consequences. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** curl improperly reuses an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different credentials for the HTTP proxy. The expected behavior is to establish or utilize a distinct connection. This issue involves incorrect handling of proxy connections and authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** The issue occurs when libcurl establishes a QUIC connection to a host specified as an IP address in the URL, resulting in the accidental skipping of certificate verification. This failure to verify certificates makes it impossible to detect impostors or man-in-the-middle attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** The issue arises from an omission in libcurl's support for pinning the server certificate public key for HTTPS transfers when using QUIC for HTTP/3 with the wolfSSL TLS backend. Although the documentation suggests that this option works with wolfSSL, it fails to specify that the check is not performed in the context of QUIC and HTTP/3. As a result, users may unwittingly connect to an impostor server without noticing, since the transfer will succeed if the pin is fine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** The issue is related to the `GTime2str()` function in libcurl's ASN1 parser code, which is used for parsing an ASN.1 Generalized Time field. If given a syntactically incorrect field, the parser might end up using -1 for the length of the `time fraction`, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when `CURLINFO CERTINFO` is used. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** The issue is related to the implementation of TLS protocols in libcurl, where the server certificate is not checked when connecting to a host specified as an IP address, when built to use mbedTLS. This affects all uses of TLS protocols, including HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc. The vulnerability can be exploited by a remote attacker to conduct spoofing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** The issue is related to a memory leak in libcurl when handling HTTP/2 server push. When the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push and inadvertently leaks memory. This error condition fails silently, making it difficult for applications to detect. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.