Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: Node.js
🔹 Reported By: br41ny
🔹 State: 🟢 Resolved
🔹 Disclosed: October 23, 2026, 5:08pm (UTC)
🐞 Source: HackerOne
A flaw was discovered in TLS hostname verification that allowed certificates with only DNS Subject Alternative Names to authenticate IP endpoints when clients connected using non-canonical IPv4 address formats. The verification function failed to classify these alternate spellings as IP addresses and instead normalized them to their canonical form, matching them against certificate DNS names. This resulted in…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: Node.js
🔹 Reported By: br41ny
🔹 State: 🟢 Resolved
🔹 Disclosed: October 23, 2026, 5:08pm (UTC)
🐞 Source: HackerOne
A flaw was discovered in TLS hostname verification that allowed certificates with only DNS Subject Alternative Names to authenticate IP endpoints when clients connected using non-canonical IPv4 address formats. The verification function failed to classify these alternate spellings as IP addresses and instead normalized them to their canonical form, matching them against certificate DNS names. This resulted in…
👉 Read full report
Permission Model bypass with fs.realpathSync
🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: 0xoroot
🔹 State: 🟢 Resolved
🔹 Disclosed: October 23, 2026, 5:38pm (UTC)
🐞 Source: HackerOne
A flaw in the Permission Model filesystem enforcement left fs.realpathSync() without required read permission checks. This was an incomplete fix of a previous vulnerability that only covered fs.realpathSync.native(). Code running under permission restrictions with limited filesystem read access was able to use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: 0xoroot
🔹 State: 🟢 Resolved
🔹 Disclosed: October 23, 2026, 5:38pm (UTC)
🐞 Source: HackerOne
A flaw in the Permission Model filesystem enforcement left fs.realpathSync() without required read permission checks. This was an incomplete fix of a previous vulnerability that only covered fs.realpathSync.native(). Code running under permission restrictions with limited filesystem read access was able to use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside…
👉 Read full report
Null Dereference in X509ToObject
🔹 Severity: Medium
🔹 Weakness: NULL Pointer Dereference
🔹 Reported To: Node.js
🔹 Reported By: hahahkim
🔹 State: 🟢 Resolved
🔹 Disclosed: October 23, 2026, 10:30pm (UTC)
🐞 Source: HackerOne
A null pointer dereference vulnerability was identified in X.509 certificate handling. The vulnerability could cause a process to crash when converting a specially crafted certificate to a JavaScript object. This vulnerability affected Node.js versions 24.x and 26.x.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: NULL Pointer Dereference
🔹 Reported To: Node.js
🔹 Reported By: hahahkim
🔹 State: 🟢 Resolved
🔹 Disclosed: October 23, 2026, 10:30pm (UTC)
🐞 Source: HackerOne
A null pointer dereference vulnerability was identified in X.509 certificate handling. The vulnerability could cause a process to crash when converting a specially crafted certificate to a JavaScript object. This vulnerability affected Node.js versions 24.x and 26.x.
👉 Read full report
Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process
🔹 Severity: Low
🔹 Weakness: Code Injection
🔹 Reported To: Nextcloud
🔹 Reported By: the_xcheater
🔹 State: 🟢 Resolved
🔹 Disclosed: October 24, 2026, 9:16pm (UTC)
🐞 Source: HackerOne
A code injection vulnerability was discovered in Nextcloud Desktop Client version 33.0.5 for macOS. The vulnerability combined two weaknesses: the QtWebEngineProcess binary was shipped with library validation disabled, and it contained dead build-server paths in its rpath that were searched before legitimate framework directories. An unprivileged local attacker could mount a disk image and plant a malicious library…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Code Injection
🔹 Reported To: Nextcloud
🔹 Reported By: the_xcheater
🔹 State: 🟢 Resolved
🔹 Disclosed: October 24, 2026, 9:16pm (UTC)
🐞 Source: HackerOne
A code injection vulnerability was discovered in Nextcloud Desktop Client version 33.0.5 for macOS. The vulnerability combined two weaknesses: the QtWebEngineProcess binary was shipped with library validation disabled, and it contained dead build-server paths in its rpath that were searched before legitimate framework directories. An unprivileged local attacker could mount a disk image and plant a malicious library…
👉 Read full report
Arbitrary `/tmp` read in discourse via `convert_heif!` decoder-confusion (regression of 4bf3bf6786)
🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Discourse
🔹 Reported By: fizzi
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 3:43am (UTC)
🐞 Source: HackerOne
A decoder confusion vulnerability was discovered in image conversion functionality that allowed arbitrary file reads from temporary directories. When HEIF/HEIC files were processed, the conversion function failed to enforce a specific decoder prefix, allowing ImageMagick to dispatch based on file magic bytes instead of extension. Files with PostScript headers were routed through Ghostscript, which executed…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Discourse
🔹 Reported By: fizzi
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 3:43am (UTC)
🐞 Source: HackerOne
A decoder confusion vulnerability was discovered in image conversion functionality that allowed arbitrary file reads from temporary directories. When HEIF/HEIC files were processed, the conversion function failed to enforce a specific decoder prefix, allowing ImageMagick to dispatch based on file magic bytes instead of extension. Files with PostScript headers were routed through Ghostscript, which executed…
👉 Read full report
CVE-2026-111483: GnuTLS accepts non-successful OCSP staples
🔹 Severity: Medium
🔹 Weakness: Improper Check for Certificate Revocation
🔹 Reported To: curl
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:21am (UTC)
🐞 Source: HackerOne
A vulnerability was identified in curl version 8.22.0 and 8.23.0 when built with GnuTLS. The --cert-status option failed to properly validate stapled OCSP responses. Instead of checking the response status and certificate status within the response, the code only verified that some stapled OCSP response was received. This allowed a revoked certificate to be accepted if accompanied by a bogus or non-successful OCSP…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Check for Certificate Revocation
🔹 Reported To: curl
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:21am (UTC)
🐞 Source: HackerOne
A vulnerability was identified in curl version 8.22.0 and 8.23.0 when built with GnuTLS. The --cert-status option failed to properly validate stapled OCSP responses. Instead of checking the response status and certificate status within the response, the code only verified that some stapled OCSP response was received. This allowed a revoked certificate to be accepted if accompanied by a bogus or non-successful OCSP…
👉 Read full report
CVE-2026-115528: wolfSSL TLS connect without cert
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:21am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in curl when built with wolfSSL that allowed TLS connections to complete without certificate verification. When using default certificate verification settings, curl accepted anonymous Diffie-Hellman cipher suites that transmitted no server certificate. This caused user credentials and request data to be sent to unauthenticated servers. The issue was caused by insufficient certificate…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:21am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in curl when built with wolfSSL that allowed TLS connections to complete without certificate verification. When using default certificate verification settings, curl accepted anonymous Diffie-Hellman cipher suites that transmitted no server certificate. This caused user credentials and request data to be sent to unauthenticated servers. The issue was caused by insufficient certificate…
👉 Read full report
CVE-2026-111951: curl -OJ truncate without filename
🔹 Severity: Low
🔹 Weakness: External Control of File Name or Path
🔹 Reported To: curl
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:22am (UTC)
🐞 Source: HackerOne
In curl versions 8.23.0, 8.22.0, and master branch, a vulnerability was identified in the tool's handling of Content-Disposition headers with the -OJ flag. When a response contained multiple Content-Disposition headers where the first lacked a filename parameter, the tool would create and truncate an existing file to zero bytes before refusing to overwrite it, contradicting documented behavior. This occurred…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: External Control of File Name or Path
🔹 Reported To: curl
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:22am (UTC)
🐞 Source: HackerOne
In curl versions 8.23.0, 8.22.0, and master branch, a vulnerability was identified in the tool's handling of Content-Disposition headers with the -OJ flag. When a response contained multiple Content-Disposition headers where the first lacked a filename parameter, the tool would create and truncate an existing file to zero bytes before refusing to overwrite it, contradicting documented behavior. This occurred…
👉 Read full report
CVE-2026-111878: OpenSSL provider UAF on TLS shutdown
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: vansukmbg
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:25am (UTC)
🐞 Source: HackerOne
A use-after-free vulnerability was identified in the OpenSSL provider implementation when using the multi interface. The vulnerability occurred when a private library context was freed while an SSL context that borrowed it remained queued for shutdown. This happened because the library context was stored only on the easy handle and was freed during cleanup before deferred shutdown operations completed. When…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: vansukmbg
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:25am (UTC)
🐞 Source: HackerOne
A use-after-free vulnerability was identified in the OpenSSL provider implementation when using the multi interface. The vulnerability occurred when a private library context was freed while an SSL context that borrowed it remained queued for shutdown. This happened because the library context was stored only on the easy handle and was freed during cleanup before deferred shutdown operations completed. When…
👉 Read full report
CVE-2026-111952: OpenSSL provider use-after-free again
🔹 Severity: Medium
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: moltenbit
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:52am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: moltenbit
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:52am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111480: pause UAF from within callback
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: rat5ak
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: rat5ak
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111481: server-set cookie still aborts cookie jar
🔹 Severity: Low
🔹 Weakness: Improper Input Validation
🔹 Reported To: curl
🔹 Reported By: samueloph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Input Validation
🔹 Reported To: curl
🔹 Reported By: samueloph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111482: libssh2 knownhosts prefix match
🔹 Severity: Low
🔹 Weakness: Partial String Comparison
🔹 Reported To: curl
🔹 Reported By: samueloph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Partial String Comparison
🔹 Reported To: curl
🔹 Reported By: samueloph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111950: TLS session cache diff scheme reuse
🔹 Severity: Low
🔹 Weakness: Incorrect Comparison
🔹 Reported To: curl
🔹 Reported By: stze
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Incorrect Comparison
🔹 Reported To: curl
🔹 Reported By: stze
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111953: GnuTLS SecTrust OCSP staple bypass
🔹 Severity: Low
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111954: upload reader failed redirect UAF
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-115529: Schannel TLS auto client session resumption
🔹 Severity: Low
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: curl
🔹 Reported By: johnnykao
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: curl
🔹 Reported By: johnnykao
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
server filename with control characters printed to terminal (`-J`)
🔹 Severity: Low
🔹 Weakness: Improper Neutralization of Escape, Meta, or Control Sequences
🔹 Reported To: curl
🔹 Reported By: gubee
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 7:55am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Neutralization of Escape, Meta, or Control Sequences
🔹 Reported To: curl
🔹 Reported By: gubee
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 7:55am (UTC)
🐞 Source: HackerOne
👉 Read full report
Derived cookie Path aborts cookie jar loading in curl 8.23.0
🔹 Severity: Low
🔹 Weakness: Improper Input Validation
🔹 Reported To: curl
🔹 Reported By: threalwinky
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 8:02am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Input Validation
🔹 Reported To: curl
🔹 Reported By: threalwinky
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 8:02am (UTC)
🐞 Source: HackerOne
👉 Read full report
Windows SSPI connection-pool probe can reuse a connection under the wrong user
🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Spoofing
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 9:09am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Spoofing
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 9:09am (UTC)
🐞 Source: HackerOne
👉 Read full report