curl

curl 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 内存破坏164
• 密码学缺陷88
• 其他弱点82
• 信息泄露80
• 业务逻辑61
• 身份认证51
• 注入与走私44
• 拒绝服务37
• 路径遍历21
• 代码执行19
• 访问控制17
• 服务端请求伪造8
• 开放重定向8
• 错误配置1
• 跨站脚本1

主要弱点

• 释放后使用48
• Unlabeled42
• 证书校验不当36
• 信息泄露33
• 业务逻辑错误33
• CRLF 注入26
• Information Exposure Through Sent Data22
• 输入校验不当21
• 资源消耗失控19
• Authentication Bypass by Primary Weakness19

常见资产

• https://github.com/curl/curlSOURCE_CODE · 664
• · 18

高票报告

当前状态 220 份 · 全部 682

1. 54
   [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames路径遍历 · 2026-09-26 · 高危
   $0路径遍历
2. 45
   MQTT Protocol Packet Injection via Unchecked CONNACK Remaining Length其他弱点 · 2026-02-05 · 低危
   $0Unlabeled
3. 45
   `Curl_socketpair()` fallback vulnerable to man-in-the-middle attack密码学缺陷 · 2025-05-20 · 未评级
   $0中间人攻击
4. 42
   mbedTLS private-key blob null-termination asymmetry in lib/vtls/mbedtls.c (mbed_load_privkey)内存破坏 · 2026-05-08 · 未评级
   $0Improper Null Termination
5. 41
   Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c信息泄露 · 2025-06-23 · 低危
   $0Information Exposure Through Sent Data
6. 38
   urlapi: off-by-one in custom scheme validation skips last character内存破坏 · 2026-03-12 · 高危
   $0Off-by-one Error
7. 37
   Bypassing Strict SSH Server Verification via Connection Pool Reuse in libcurl业务逻辑 · 2026-04-01 · 未评级
   $0Unlabeled
8. 36
   MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstate其他弱点 · 2026-04-30 · 中危
   $0输入校验不当
9. 36
   Sensitive information disclosure with malicious netrc file信息泄露 · 2025-06-22 · 中危
   $0LLM06: Sensitive Information Disclosure
10. 35
    Windows filename sanitizer misses Unicode COM/LPT reserved device names其他弱点 · 2026-09-24 · 低危
    $0Unlabeled
11. 35
    Credentials forwarded to HTTP after HTTPS→HTTP same-port redirect — url_set_data_creds uses scheme-blind comparator开放重定向 · 2026-05-21 · 低危
    $0Unlabeled
12. 31
    Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts信息泄露 · 2026-08-21 · 未评级
    $0Information Exposure Through Sent Data
13. 31
    MQTT CONNACK Packet Type Bypass leads to RCE via Malicious Broker代码执行 · 2026-05-05 · 严重
    $0ASI05: Unexpected Code Execution (RCE)
14. 30
    SSH/SFTP connection reuse can bypass SSH key identity after ssh_config_matches removal身份认证 · 2026-06-09 · 高危
    $0Authentication Bypass by Primary Weakness
15. 30
    Schannel custom-CA path skips Extended Key Usage enforcement业务逻辑 · 2026-05-19 · 未评级
    $0业务逻辑错误
16. 30
    lib/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a)身份认证 · 2026-04-16 · 中危
    $0Authentication Bypass by Primary Weakness
17. 30
    HTTP/1.1 Response Desynchronization via conflicting CL/TE headers in Proxy CONNECT注入与走私 · 2026-03-25 · 低危
    $0HTTP 请求走私
18. 30
    Apple SecTrust legacy path accepts untrusted certificates on pre-10.14 macOS/iOS when built with USE_APPLE_SECTRUST密码学缺陷 · 2025-10-09 · 高危
    $0证书校验不当
19. 30
    OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients)拒绝服务 · 2025-10-08 · 低危
    $0资源消耗失控
20. 30
    Use After Free (that leads to arbitrary Write for some versions)内存破坏 · 2025-08-06 · 未评级
    $0释放后使用
21. 29
    libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms信息泄露 · 2026-04-20 · 中危
    $0信息泄露
22. 29
    Heap‑based buffer overflow in curl -K <config_file> allows arbitrary write .内存破坏 · 2025-04-28 · 高危
    $0堆溢出
23. 28
    Curl_compareheader() fails to match multi-value HTTP headers业务逻辑 · 2026-03-12 · 中危
    $0Expected Behavior Violation
24. 28
    RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload)其他弱点 · 2026-02-27 · 低危
    $0Improper Check or Handling of Exceptional Conditions
25. 28
    Memory Leak内存破坏 · 2025-05-11 · 未评级
    $0内存破坏（通用）