CVE-2026-115528: wolfSSL TLS connect without cert
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:21am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in curl when built with wolfSSL that allowed TLS connections to complete without certificate verification. When using default certificate verification settings, curl accepted anonymous Diffie-Hellman cipher suites that transmitted no server certificate. This caused user credentials and request data to be sent to unauthenticated servers. The issue was caused by insufficient certificate…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:21am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in curl when built with wolfSSL that allowed TLS connections to complete without certificate verification. When using default certificate verification settings, curl accepted anonymous Diffie-Hellman cipher suites that transmitted no server certificate. This caused user credentials and request data to be sent to unauthenticated servers. The issue was caused by insufficient certificate…
👉 Read full report
CVE-2026-111951: curl -OJ truncate without filename
🔹 Severity: Low
🔹 Weakness: External Control of File Name or Path
🔹 Reported To: curl
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:22am (UTC)
🐞 Source: HackerOne
In curl versions 8.23.0, 8.22.0, and master branch, a vulnerability was identified in the tool's handling of Content-Disposition headers with the -OJ flag. When a response contained multiple Content-Disposition headers where the first lacked a filename parameter, the tool would create and truncate an existing file to zero bytes before refusing to overwrite it, contradicting documented behavior. This occurred…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: External Control of File Name or Path
🔹 Reported To: curl
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:22am (UTC)
🐞 Source: HackerOne
In curl versions 8.23.0, 8.22.0, and master branch, a vulnerability was identified in the tool's handling of Content-Disposition headers with the -OJ flag. When a response contained multiple Content-Disposition headers where the first lacked a filename parameter, the tool would create and truncate an existing file to zero bytes before refusing to overwrite it, contradicting documented behavior. This occurred…
👉 Read full report
CVE-2026-111878: OpenSSL provider UAF on TLS shutdown
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: vansukmbg
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:25am (UTC)
🐞 Source: HackerOne
A use-after-free vulnerability was identified in the OpenSSL provider implementation when using the multi interface. The vulnerability occurred when a private library context was freed while an SSL context that borrowed it remained queued for shutdown. This happened because the library context was stored only on the easy handle and was freed during cleanup before deferred shutdown operations completed. When…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: vansukmbg
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:25am (UTC)
🐞 Source: HackerOne
A use-after-free vulnerability was identified in the OpenSSL provider implementation when using the multi interface. The vulnerability occurred when a private library context was freed while an SSL context that borrowed it remained queued for shutdown. This happened because the library context was stored only on the easy handle and was freed during cleanup before deferred shutdown operations completed. When…
👉 Read full report
CVE-2026-111952: OpenSSL provider use-after-free again
🔹 Severity: Medium
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: moltenbit
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:52am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: moltenbit
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:52am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111480: pause UAF from within callback
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: rat5ak
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: rat5ak
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111481: server-set cookie still aborts cookie jar
🔹 Severity: Low
🔹 Weakness: Improper Input Validation
🔹 Reported To: curl
🔹 Reported By: samueloph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Input Validation
🔹 Reported To: curl
🔹 Reported By: samueloph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111482: libssh2 knownhosts prefix match
🔹 Severity: Low
🔹 Weakness: Partial String Comparison
🔹 Reported To: curl
🔹 Reported By: samueloph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Partial String Comparison
🔹 Reported To: curl
🔹 Reported By: samueloph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:53am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111950: TLS session cache diff scheme reuse
🔹 Severity: Low
🔹 Weakness: Incorrect Comparison
🔹 Reported To: curl
🔹 Reported By: stze
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Incorrect Comparison
🔹 Reported To: curl
🔹 Reported By: stze
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111953: GnuTLS SecTrust OCSP staple bypass
🔹 Severity: Low
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-111954: upload reader failed redirect UAF
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-115529: Schannel TLS auto client session resumption
🔹 Severity: Low
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: curl
🔹 Reported By: johnnykao
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: curl
🔹 Reported By: johnnykao
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 7:54am (UTC)
🐞 Source: HackerOne
👉 Read full report
server filename with control characters printed to terminal (`-J`)
🔹 Severity: Low
🔹 Weakness: Improper Neutralization of Escape, Meta, or Control Sequences
🔹 Reported To: curl
🔹 Reported By: gubee
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 7:55am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Neutralization of Escape, Meta, or Control Sequences
🔹 Reported To: curl
🔹 Reported By: gubee
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 7:55am (UTC)
🐞 Source: HackerOne
👉 Read full report
Derived cookie Path aborts cookie jar loading in curl 8.23.0
🔹 Severity: Low
🔹 Weakness: Improper Input Validation
🔹 Reported To: curl
🔹 Reported By: threalwinky
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 8:02am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Input Validation
🔹 Reported To: curl
🔹 Reported By: threalwinky
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 8:02am (UTC)
🐞 Source: HackerOne
👉 Read full report
Windows SSPI connection-pool probe can reuse a connection under the wrong user
🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Spoofing
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 9:09am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Spoofing
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 9:09am (UTC)
🐞 Source: HackerOne
👉 Read full report
20: HTAB before `Secure` attribute silently drops the Secure cookie flag
🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔵 Duplicate
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔵 Duplicate
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne
👉 Read full report
14: HSTS cache import silently drops a longer-lived child beneath an includeSubDomains parent
🔹 Severity: No Rating
🔹 Weakness: Cleartext Transmission of Sensitive Information
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔵 Duplicate
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: No Rating
🔹 Weakness: Cleartext Transmission of Sensitive Information
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔵 Duplicate
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne
👉 Read full report
FTP authentication options leak to a cross-origin FTP redirect with unrestricted auth disabled
🔹 Severity: Low
🔹 Weakness: Insufficiently Protected Credentials
🔹 Reported To: curl
🔹 Reported By: galcan
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Insufficiently Protected Credentials
🔹 Reported To: curl
🔹 Reported By: galcan
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne
👉 Read full report
OpenSSL provider OSSL_LIB_CTX used after free via the connection shutdown list (CVE-2026-80229 fix incomplete)
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🔵 Duplicate
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🔵 Duplicate
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne
👉 Read full report
A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disable
🔹 Severity: High | 💰 4,000 USD
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Mozilla
🔹 Reported By: timhaines
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 10:49am (UTC)
🐞 Source: HackerOne
A Bugzilla instance had inconsistent authentication validation across its API implementations. The newer REST routes failed to verify account status when processing API keys, while the legacy REST API and web interface correctly rejected disabled accounts. This allowed disabled accounts' API keys to remain functional on the newer routes, including for security-sensitive bug operations. The vulnerability was…
👉 Read full report
🔹 Severity: High | 💰 4,000 USD
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Mozilla
🔹 Reported By: timhaines
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 10:49am (UTC)
🐞 Source: HackerOne
A Bugzilla instance had inconsistent authentication validation across its API implementations. The newer REST routes failed to verify account status when processing API keys, while the legacy REST API and web interface correctly rejected disabled accounts. This allowed disabled accounts' API keys to remain functional on the newer routes, including for security-sensitive bug operations. The vulnerability was…
👉 Read full report
Vercel subdomain takeover — capitalcalc.settle.com & embed.settle.com
🔹 Severity: Medium
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: jagdishpandey
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Medium
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: jagdishpandey
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026
🐞 Source: Bugcrowd
👉 Read full report