Tor onion service INTRODUCE2 invalid-MAC cells permanently grow service replay cache

🔹 Severity: Low
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Tor
🔹 Reported By: geeknik
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2026, 12:10pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in Tor's onion service INTRODUCE2 handling. A remote client could send well-formed INTRODUCE1 cells with an invalid MAC, but a unique byte pattern. The introduction point would forward these cells as INTRODUCE2 to the onion service. The onion service would insert the attacker-controlled encrypted section into the introduction-point replay cache before verifying the INTRODUCE2 MAC. The…

👉 Read full report

Conflux-queued zero-length RELAY_END triggers heap out-of-bounds read

🔹 Severity: Medium
🔹 Weakness: Out-of-bounds Read
🔹 Reported To: Tor
🔹 Reported By: geeknik
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2026, 12:10pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in Tor that could trigger a heap out-of-bounds read when a zero-length RELAY_END cell was processed on a non-open AP stream. The vulnerability was caused by the way Tor handles these cells, where the reason byte was read before checking the message length. This issue was compounded by Conflux's out-of-order delivery, which could copy the zero-length message into an exact-size heap…

👉 Read full report

27: IMAP custom FETCH listing classification skips literal boundaries, enabling response desynchronization

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 10, 2026, 3:09pm (UTC)
🐞 Source: HackerOne

👉 Read full report

IMAP connection reuse runs requests in the wrong case-sensitive mailbox

🔹 Severity: Low
🔹 Weakness: Improper Handling of Case Sensitivity
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: September 10, 2026, 3:09pm (UTC)
🐞 Source: HackerOne

👉 Read full report

12: SASL DIGEST-MD5 does not validate the server's `rspauth` proof

🔹 Severity: No Rating
🔹 Weakness: Missing Critical Step in Authentication
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 10, 2026, 3:09pm (UTC)
🐞 Source: HackerOne

👉 Read full report

55: Heap-buffer-overflow read in `curl_formadd_ccsid()` with binary form data

🔹 Severity: No Rating
🔹 Weakness: Out-of-bounds Read
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 10, 2026, 3:10pm (UTC)
🐞 Source: HackerOne

👉 Read full report

Publicly Accessible Project Documentation Exposes Extensive Project Personnel Contact Information

🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: nafee7hh
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2026
🐞 Source: Bugcrowd

👉 Read full report

Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown

🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: Ruby on Rails
🔹 Reported By: seoafoz
🔹 State: 🟢 Resolved
🔹 Disclosed: September 12, 2026, 7:08pm (UTC)
🐞 Source: HackerOne

👉 Read full report

HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers

🔹 Severity: High | 💰 1,500 USD
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: 1nsomnia1102
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2026, 4:57am (UTC)
🐞 Source: HackerOne

A vulnerability was found in Pingora that could allow HTTP request smuggling through improper handling of hop-by-hop headers. The issue was fixed in Pingora 0.9.0.

👉 Read full report

[Atlas Browser] Fullscreen notification is missing when requestFullscreen() is called from a popup window

🔹 Severity: Low
🔹 Reported To: OpenAI
🔹 Reported By: Moch_Azril
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2026
🐞 Source: Bugcrowd

👉 Read full report

[Atlas Browser] Fullscreen Notification Overlap by Screen Share Permission Dialog Leading to UI Spoofing and Unauthorized Screen Capture in ChatGPT Atlas for macOS

🔹 Severity: Low
🔹 Reported To: OpenAI
🔹 Reported By: Moch_Azril
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2026
🐞 Source: Bugcrowd

👉 Read full report

37: `curl_mprintf` `%F` format specifier not consumed, causing variadic argument desynchronization

🔹 Severity: No Rating
🔹 Weakness: Type Confusion
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:58am (UTC)
🐞 Source: HackerOne

👉 Read full report

10: CURLOPT_MAXLIFETIME_CONN bypass on active HTTP/2 connections

🔹 Severity: No Rating
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:58am (UTC)
🐞 Source: HackerOne

👉 Read full report

56: IBM i CL wrapper `parse_command_line()` never enters quote mode

🔹 Severity: No Rating
🔹 Weakness: Command Injection - Generic
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:58am (UTC)
🐞 Source: HackerOne

👉 Read full report

53: HTTP/1 CONNECT chunked-407 trailers bypass CURLOPT_SUPPRESS_CONNECT_HEADERS and lose CURLH_CONNECT classification

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:58am (UTC)
🐞 Source: HackerOne

👉 Read full report

Heap-use-after-free in CURLOPT_REFERER when passed a CURLINFO_REFERER pointer

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:59am (UTC)
🐞 Source: HackerOne

👉 Read full report