地图 / TLS conn reuse and session cache ignore fsslctx callback and ssl_config_data flags ( incomplete fix variant of 7541ae569 )

TLS conn reuse and session cache ignore fsslctx callback and ssl_config_data flags ( incomplete fix variant of 7541ae569 )

身份认证 / 凭据保护不足 / #3761647

厂商: curl
严重程度: 中危
赏金: —
弱点: 凭据保护不足
研究员: @fg0x0
披露日期: 2026-06-01
资产: https://github.com/curl/curl
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（6015 字符中的一小部分）

`match_ssl_primary_config()` in `lib/vtls/vtls.c:194` and the session-cache key built by `cf_ssl_peer_key_build()` in `lib/vtls/vtls_scache.c:240` both compare only `struct ssl_primary_config` fields when deciding whether to reuse a TLS connection or cached session. Several fields that materially …

原文中的代码

curl 8.14.0-DEV (x86_64-pc-linux-gnu) libcurl/8.14.0-DEV OpenSSL/3.5.0

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。

时间线

2026-05-26报告提交
2026-06-01公开披露

阅读 HackerOne 原文 ↗作者 @fg0x0 · 版权归作者与 curl 所有

同类报告

Account takeover via leaked session cookieHackerOne · 2019-12-03 · $20,000 h1-202 leaderboard photo discloses local wifi passwordHackerOne · 2018-03-25 HackerOne Code sends live password-reset tokens to Segment in automatic page eventsHackerOne · 2026-09-24 · $200 Authentication Token Theft via Open Redirect in Callback URL Parameterlemlist · 2025-11-14 Weak/Auto Fill PasswordMTN Group · 2022-09-03 HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocksHackerOne · 2026-10-08 · $200

TLS conn reuse and session cache ignore fsslctx callback and ssl_config_data flags ( incomplete fix variant of 7541ae569 ) · 破甲 POJIA