POJIA破甲
地图 / Memory leak from doh_write_cb

Memory leak from doh_write_cb

拒绝服务 / Allocation of Resources Without Limits or Throttling / #3089595

厂商
curl
严重程度
低危
赏金
—
弱点
Allocation of Resources Without Limits or Throttling
研究员
@catenacyber
披露日期
2025-06-29
资产
https://github.com/curl/curl
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(2828 字符中的一小部分)
Affected version [Which curl/libcurl version are you using to reproduce? On which platform? `curl -V` typically generates good output to include]
原文中的代码
==14==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 107 byte(s) in 1 object(s) allocated from:
    #0 0x55da4969379c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3
    #1 0x55da496ff27b in curl_dbg_realloc /src/curl/lib/memdebug.c:265:9
    #2 …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 curl 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @catenacyber · 版权归作者与 curl 所有

同类报告

CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize()Internet Bug Bounty · 2024-11-30 · $2,162High resource consumption by insufficient sanitization of forum threads paginationFlickr · 2025-11-24 · $479Memory Leak in libcurl via Location Header Handling (CWE-770)curl · 2025-05-22Security check upcurl · 2025-07-24HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiBcurl · 2026-05-19Unbounded memory growth with session handling in TLSv1.3Internet Bug Bounty · 2024-09-22 · $497