Daniel Stenberg

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** A disconnect between the tool layer and libcurl occurs when a user invokes curl with a schemeless URL and the `--proto-default` option set to sftp or scp. The tool layer incorrectly infers the URL scheme, which bypasses the initialization of critical SSH security options, specifically `CURLOPT SSH HOST PUBLIC KEY SHA256` and `CURLOPT SSH KNOWNHOSTS`. While the libcurl runtime still establishes the connection via SFTP or SCP, the omission of these host verification options allows curl to connect to an unverified SSH remote host without triggering an error. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** When performing a transfer to a specific HTTP origin (`hostA`) using Digest authentication and subsequently changing the origin to a different one (`hostB`) while reusing the same handle, libcurl incorrectly forwards the `Authorization:` header intended for `hostA` to `hostB`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** An issue exists where the HTTP `Referer:` header persists even after being explicitly cleared. Although passing NULL to `CURLOPT REFERER` is intended to suppress the header, the internal state is not cleared. This causes the previous referrer string to be reused and sent in subsequent requests, which may lead to the leakage of sensitive information to unintended servers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A use-after-free issue occurs when the `curl easy pause()` function is called within the event-based `CURLMOPT SOCKETFUNCTION` callback. This leads to a situation where libcurl attempts to store a flag using a dangling struct pointer immediately after the memory associated with that pointer has been freed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A flaw exists where the software fails to clear proxy authentication credentials when instructed to do so. This results in old credentials remaining available and potentially being used for subsequent transfers that should not have access to them. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** When reusing a handle for sequential transfers driven by environment-variable proxy configuration, the software fails to clear the proxy authentication state between requests. If an initial transfer authenticates against a proxy using Digest authentication, a subsequent transfer routed through a different proxy erroneously leaks the `Proxy-Authorization:` header intended for the first proxy. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** A flaw in the cookie parsing logic allows a malicious HTTP server to set super cookies that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that are subsequently scoped and transmitted to unrelated third-party domains. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A logical error in the connection pooling mechanism may cause libcurl to reuse an incorrect connection for SMB(S) transfers. When reusing a connection, specific criteria must be met; however, a request could wrongfully reuse an existing SMB connection to the same server that utilized a different share than the subsequent transfer requires. This may result in downloading the wrong file or uploading a file to an incorrect location, provided the same credentials and server name are used. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** A flaw exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is performed in clear-text via IMAP, SMTP, or POP3, a subsequent request to the same host bypasses the TLS requirement and transmits data unencrypted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When using libcurl, a flaw exists where a custom `Host:` header set for an initial HTTP request can cause subsequent requests using the same easy handle to use stale information. If the second request is made without a custom `Host:` header, it may leak cookies intended for the first host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** curl may erroneously pass credentials intended for a first proxy to a second proxy. This occurs when curl is configured to use different proxies for different URL schemes, the first proxy requires credentials, the second proxy does not, and curl is redirected from a URL using the first proxy's scheme (e.g., `http://`) to a URL using a different scheme (e.g., `https://`) that utilizes the second proxy. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** When configured to use a `.netrc` file for credentials and to follow HTTP redirects, libcurl may leak the password used for the initial host to the subsequent host during the redirect process under certain circumstances. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When using libcurl to perform a transfer over a specific HTTP proxy (`proxyA`) with Digest authentication and subsequently changing the proxy host to a second one (`proxyB`) while reusing the same handle, libcurl incorrectly sends the `Proxy-Authorization:` header intended for `proxyA` to `proxyB`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under certain circumstances. Specifically, if the hostname that the first request is redirected to has information in the used .netrc file, with either the `machine` or `default` keywords, curl would pass on the bearer token set for the first host to the second one. The .netrc file stores credentials, and this issue could expose sensitive tokens. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** libcurl may reuse an incorrect connection when handling Negotiate-authenticated HTTP or HTTPS requests. This occurs because libcurl maintains a pool of recent connections to avoid overhead. A logical error can cause a request to reuse a connection authenticated with different credentials than expected, as Negotiate sometimes authenticates connections rather than individual requests. Specifically, if an application authenticates with `user1:password1` and then attempts another operation with `user2:password2` while the first connection remains active, the second request might incorrectly reuse the connection associated with `user1`. The authentication methods are configured using the `CURLOPT HTTPAUTH` option. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** The software lacks proper host verification when establishing SSH connections for SFTP operations using the wolfSSH backend. This flaw allows for man-in-the-middle (MITM) attacks to go undetected, as any host key is accepted. The issue stems from a flaw in the code managing SSH connections. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** When asked to use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libcurl versions using zlib 1.2.0.3 or older Description: The issue is related to automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT ACCEPT ENCODING` option. An attacker-controlled integer overflow can cause libcurl to perform a buffer overflow when using zlib 1.2.0.3 or older. This can potentially allow a remote attacker to bypass the ASLR protection mechanism, execute arbitrary code, or cause a denial of service. Recommendations: For libcurl versions using zlib 1.2.0.3 or older, consider disabling the `CURLOPT ACCEPT ENCODING` option as a temporary workaround until a patch is available. Restrict access to the vulnerable zlib library to minimize the risk of exploitation. Avoid using the `CURLOPT ACCEPT ENCODING` option with zlib versions 1.2.0.3 or older until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libcurl (affected versions not specified) Description: The issue arises when libcurl wrongly closes the same eventfd file descriptor twice after completing a threaded name resolve and taking down a connection channel. This problem occurs due to incorrect handling of the eventfd file descriptor. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** curl (affected versions not specified) **Description** The curl software is subject to a security issue. Details regarding the nature of the issue are not available from the provided information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.