Accessibility. This issue was addressed through improved state management.

wcurl path traversal with percent-encoded slashes =================================================

Project curl Security Advisory, November 4 2025 - Permalink

VULNERABILITY -------------

URLs containing percent-encoded slashes (/ or \) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it.

INFO ----

wcurl will not overwrite any files if the curl version is >= 7.83.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2025-11563 to this issue.

CWE-35: Path Traversal

Severity: Moderate

AFFECTED VERSIONS -----------------

- Affected versions: wcurl shipped with curl 8.14.0 to and including 8.16.0 - Affected versions: wcurl 2024.12.08 to and including 2025.09.27 - Not affected versions: wcurl shipped with curl < 8.14.0 and >= 8.17.0 - Not affected versions: wcurl < 2024.12.08 and >= 2025.11.04 - Introduced-in: https://github.com/curl/wcurl/commit/e01d578582a23695ee3cec08 - Introduced-in: https://github.com/curl/curl/commit/23bed347b3892277938259

This flaw only affects the wcurl command line tool.

SOLUTION ------------

Starting in wcurl 2025.11.04 (shipped with curl 8.17.0), this mistake is fixed.

- Fixed-in: https://github.com/curl/wcurl/commit/524f7e733237cd26553dfd - Fixed-in: https://github.com/curl/curl/commit/fb0c014e30e5f4de7aa0d566c

RECOMMENDATIONS --------------

A - Upgrade wcurl to the one shipped in curl version 8.17.0, wcurl to version 2025.11.04

B - Apply the patch to your local wcurl version

C - Explicitly choose an output filename with -o/-O/--output

D - Disable percent-decoding for output filenames with --no-decode-filename

TIMELINE --------

This issue was reported to the curl project on October 6, 2025. We contacted distros@openwall on October 30.

wcurl 2025.11.04 was released on November 4 2025, coordinated with the publication of this advisory.

curl 8.17.0 was released on November 5 2025.

The curl security team is not aware of any active exploits using this vulnerability.

CREDITS -------

- Reported-by: Stanislav Fort (Aisle Research) - Patched-by: Samuel Henrique - Patched-by: Sergio Durigan Junior

Thanks a lot!

--

/ daniel.haxx.se || https://rock-solid.curl.dev

bearer token leak on cross-protocol redirect ============================================

Project curl Security Advisory, January 7 2026 - Permalink

VULNERABILITY -------------

When an oauth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

INFO ----

By default, curl only allows redirects to HTTP(S) and FTP(S), but can be asked to allow redirects to all protocols curl supports. This vulnerability only triggers for users who use OAUTH2 bearer and who actively enable redirects to one of the four protocols mentioned above and one of those schemes is used in the HTTP redirect. A highly unusual combination.

The redirect-to URL needs to have the user name component set (but not the password) to trigger this flaw.

This token leak also happens if the redirect is done to the same hostname, just a different protocol (and port).

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2025-14524 to this issue.

CWE-522: Insufficiently Protected Credentials

Severity: Low

AFFECTED VERSIONS -----------------

- Affected versions: curl 7.33.0 to and including 8.17.0 - Not affected versions: curl < 7.33.0 and >= 8.18.0 - Introduced-in: https://github.com/curl/curl/commit/06c1bea72faabb6fad4b7ef8

libcurl is used by many applications, but not always advertised as such!

This bug is not considered a C mistake. It is not likely to have been avoided had we not been using C.

This flaw also affects the curl command line tool.

SOLUTION ------------

Starting in curl 8.18.0, this mistake is fixed.

- Fixed-in: https://github.com/curl/curl/commit/1a822275d333dc6da6043497160fd

RECOMMENDATIONS --------------

A - Upgrade curl to version 8.18.0

B - Avoid allowing cross-protocol redirects

C - Avoid using oauth2 bearer tokens

TIMELINE --------

This issue was reported to the curl project on December 9, 2025. We contacted distros@openwall on December 30, 2025.

curl 8.18.0 was released on January 7 2026 around 07:00 UTC, coordinated with the publication of this advisory.

The curl security team is not aware of any active exploits using this vulnerability.

CREDITS -------

- Reported-by: anonymous237 on hackerone - Patched-by: Daniel Stenberg

Thanks a lot!

--

/ daniel.haxx.se || https://rock-solid.curl.dev

libssh global knownhost override ================================

Project curl Security Advisory, January 7 2026 - Permalink

VULNERABILITY -------------

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file.

INFO ----

This flaw only exists when libcurl is built to use the libssh backend, not the libssh2 based one. This problem happened because libssh has a somewhat surprising API choice where they fall back to a built-in global knownhosts file if the host was not found in the specified one. The global file that was used as a fallback gets its set path at build time.

The fix now makes libcurl set both knownhost files to the same path.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2025-15079 to this issue.

CWE-297: Improper Validation of Certificate with Host Mismatch

Severity: Low

AFFECTED VERSIONS -----------------

- Affected versions: curl 7.58.0 to and including 8.17.0 - Not affected versions: curl < 7.58.0 and >= 8.18.0 - Introduced-in: https://github.com/curl/curl/commit/c92d2e14cfb0db662f958effd2ac86f99

libcurl is used by many applications, but not always advertised as such!

This bug is not considered a C mistake. It is not likely to have been avoided had we not been using C.

This flaw also affects the curl command line tool.

SOLUTION ------------

Starting in curl 8.18.0, this mistake is fixed.

- Fixed-in: https://github.com/curl/curl/commit/adca486c125d9a6d9565b9607a19dce803

RECOMMENDATIONS --------------

A - Upgrade curl to version 8.18.0

B - Build curl with the libssh2 backend

C - Avoid using SFTP or SCP

TIMELINE --------

This issue was reported to the curl project on December 24, 2025. We contacted distros@openwall on December 30, 2025.

curl 8.18.0 was released on January 7 2026 around 07:00 UTC, coordinated with the publication of this advisory.

The curl security team is not aware of any active exploits using this vulnerability.

CREDITS -------

- Reported-by: Harry Sintonen - Patched-by: Daniel Stenberg

Thanks a lot!

--

/ daniel.haxx.se || https://rock-solid.curl.dev

wrong proxy connection reuse with credentials =============================================

Project curl Security Advisory, March 11th 2026 Permalink

VULNERABILITY -------------

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

INFO ----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-3784 to this issue.

CWE-305: Authentication Bypass by Primary Weakness

Severity: Low

AFFECTED VERSIONS -----------------

- Affected versions: curl 7.7 to and including 8.18.0 - Not affected versions: curl < 7.7 and >= 8.19.0 - Introduced-in: https://github.com/curl/curl/commit/a1d6ad26100bc493c7b

libcurl is used by many applications, but not always advertised as such!

This bug is not considered a C mistake. It is not likely to have been avoided had we not been using C.

This flaw also affects the curl command line tool.

SOLUTION --------

curl 8.19.0 fixes this flaw

- Fixed-in: https://github.com/curl/curl/commit/5f13a7645e565c5c1a06f3

RECOMMENDATIONS ---------------

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade to curl and libcurl 8.19.0

B - Apply the patch and rebuild libcurl

C - Avoid using HTTP proxy with alternating credentials

TIMELINE ---------

It was reported to the curl project on March 4th 2026. We contacted distros@openwall on March 8.

libcurl 8.19.0 was released on March 11th 2026, coordinated with the publication of this advisory.

CREDITS -------

- Reported-by: Muhamad Arga Reksapati (HackerOne: nobcoder) - Patched-by: Stefan Eissing

Thanks a lot!

--

/ daniel.haxx.se || https://rock-solid.curl.dev