地图 / curl/libcurl 8.20.0 NOPROXY bypass via uppercase-hex IPv4 aliases leaks off-proxy Basic credentials to the configured proxy

curl/libcurl 8.20.0 NOPROXY bypass via uppercase-hex IPv4 aliases leaks off-proxy Basic credentials to the configured proxy

信息泄露 / Unlabeled / #3773293

厂商: curl
严重程度: 低危
赏金: —
弱点: Unlabeled
研究员: @arkss
披露日期: 2026-06-03
资产: https://github.com/curl/curl
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（5196 字符中的一小部分）

Summary: curl/libcurl 8.20.0 fails to enforce `CURLOPT_NOPROXY`, `--noproxy`, and `NO_PROXY` consistently for uppercase-hex IPv4 aliases such as `0X7f.1` on glibc-based systems that accept these legacy numeric IPv4 forms.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。

时间线

2026-05-31报告提交
2026-06-03公开披露

阅读 HackerOne 原文 ↗作者 @arkss · 版权归作者与 curl 所有

同类报告

Github access token exposureShopify · 2021-07-26 · $50,000 Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`HackerOne · 2025-01-21 · $25,000 Informations disclosure - Access to some checkout informationsShopify · 2021-03-13 Disclosure handle private program with external linkHackerOne · 2021-08-24 · $2,500 Cloudflare WAF Bypass - Origin IP ExposureHemi VDP · 2025-03-27 [Zomato Order] Insecure deeplink leads to sensitive information disclosureEternal · 2021-09-23 · $750