Graph/curl

Component

curl

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0004

Connections

28 linked nodes

Network Security / File Transfer

AFFECTSRootCause

only compares user/passwd/sasl_authzid/oauth_bearer in the reuse-match check — lib/url.c ConnectionExists(). Outcome: which drive the ACCT command and USER fallback in lib/ftp.c.

AFFECTSRootCause

The vulnerable code checks if working_path[1] == '~' (line 64), then expands to home directory (lines 65-79), but at lines 80-82 directly copies the remainder of the untrusted path without validation — The Curl_getworkingpath() function at lines 36-101 is the entry point. SFTP-specific handling starts at line 63. Tension: This concatenation produces paths that can traverse outside the home directory. Outcome: memcpy(real_path + homelen, working_path + 3, 1 + working_path_len - 3).

AFFECTSRootCause

tool_header_cb() callback in src/tool_cb_hdr.c uses rename() to move files based on filenames extracted from untrusted HTTP headers. Tension: rename() follows symlinks. Outcome: The vulnerable code at lines 188-205 contains a rename() call.

AFFECTSProblem

curl versions prior to 7.71.0. Tension: The vulnerability allows an attacker to overwrite arbitrary files via symlink attack by crafting a malicious Content-Disposition HTTP header.

AFFECTSRootCause

the guard `if(!socks5_resolve_local && hostname_len > 255)` (line 589) is INSIDE `case CONNECT_SOCKS_INIT:`. Tension: `socks5_resolve_local` remains FALSE for SOCKS5_HOSTNAME proxy type.

AFFECTSRootCause

Outcome: with -i + -J, show_headers creates the file without is_cd_filename=TRUE → entire protection skipped.

AFFECTSSolution

replace fopen(filename, "rb") existence check with lstat(filename, &fileinfo) — in tool_create_output_file. Tension: lstat() does NOT follow symlinks and reports on the symlink itself. Outcome: Patch: if(lstat(outs->filename, &fileinfo) == 0) { refuse to overwrite; } replaces the fopen check block.

AFFECTSSolution

Two-part fix matching the upstream curl 8.0.0 patch — in the SFTP block of `Curl_getworkingpath`.

AFFECTSRootCause

Setting CURLOPT_POSTFIELDS changes set.method to HTTPREQ_POST but does not clear set.upload or rebind data->state.fread_func/data->state.in — when POST follows PUT on the same handle with connection reuse. Tension: the stale PUT read-callback (and its possibly-freed user buffer) is still invoked when the POST body is sent.

AFFECTSRootCause

file loading at line 1255 calls Curl_cookie_add(data, c, headerline, TRUE, lineptr, NULL, NULL, TRUE) — PSL check block at lines 1025-1048 guarded by USE_LIBPSL with guard condition requiring domain!=NULL. Tension: domain=NULL skips PSL.

AFFECTSRootCause

when response headers arrive. Outcome: This can also be amplified to overwrite files outside cwd if the user has a symlink in cwd.

AFFECTSSolution

Two equivalent fixes, both at src/tool_cb_hdr.c:tool_header_cb and src/tool_cb_wrt.c:tool_write_cb — while -J is still waiting for Content-Disposition. Tension: do not create the output file from the header or body callback. Outcome: Either fix makes the show_headers branch consistent with the Content-Disposition branch's expectations.

AFFECTSSolution

Extend the !PROTOPT_CREDSPERREQUEST comparison to include all options that change the connection's authenticated identity. Tension: a connection-pool match predicate must include every input that affects the authenticated/authorized state. Outcome: Matches upstream fix in commit cb49e67303dbafbab1cebf4086e3ec15b7d56ee5.

AFFECTSRootCause

If the initial auth-method send is partial, the function returns early with state CONNECT_SOCKS_SEND. Tension: on re-entry, the INIT case is skipped, the guard never runs.

AFFECTSSolution

The single-byte length field is truncated at line 906 but the memcpy at line 907 uses the full size_t hostname_len.

PERTAIN_TOProblem

A second transfer that changes those options silently reuses the already-authenticated control connection — curl 7.88.0 lib/url.c ConnectionExists() pools FTP control connections. Outcome: executing under the prior session identity = authentication bypass / wrong-creds-used.

PERTAIN_TOProblem

curl versions prior to 7.71.0. Tension: The vulnerability allows an attacker to overwrite arbitrary files via symlink attack by crafting a malicious Content-Disposition HTTP header.

PERTAIN_TOProblem

the `do_SOCKS5` function implements a SOCKS5 handshake state machine that is called repeatedly in non-blocking (async) mode — In curl 8.3.0 (lib/socks.c). Outcome: producing a heap overflow when hostname_len > (buffer_size - 7).

PERTAIN_TOSolution

The fix is to move `socks5_resolve_local` from a local variable into the persistent `socks_state` struct. Tension: so the CONNECT_SOCKS_INIT decision persists across multiple async invocations. Outcome: The actual CVE patch added `bool socks5_resolve_local` to the socks_state struct.

PERTAIN_TOProblem

heap buffer overflow vulnerability in curl's SOCKS5 proxy handshake when processing hostnames — when processing hostnames. Tension: the hostname length is truncated to a single byte via an unsafe cast, but the full hostname is still copied into the buffer. Outcome: causing heap memory corruption.

PERTAIN_TOSolution

curl (version 8.4.0 and earlier) has a logic bug in its cookie engine. Outcome: located a PoC file in the repo at repos/curl/cve_2023_46218_poc.c confirming the Curl_cookie_getlist() angle.

PERTAIN_TOSolution

Two equivalent fixes, both at src/tool_cb_hdr.c:tool_header_cb and src/tool_cb_wrt.c:tool_write_cb — while -J is still waiting for Content-Disposition. Tension: do not create the output file from the header or body callback. Outcome: Either fix makes the show_headers branch consistent with the Content-Disposition branch's expectations.

ENRICHESSolution

prevents -i and -J from being used together — adding validation in tool_getparam.c. Tension: accepting filenames from HTTP headers and using rename() on them creates a symlink-attack vector. Outcome: rejects PARAM_BAD_USE when both flags are specified.

IMPLEMENTATION_OFDomain

Network Security

IMPLEMENTATION_OFProblem

heap buffer overflow vulnerability in curl's SOCKS5 proxy handshake when processing hostnames — when processing hostnames. Tension: the hostname length is truncated to a single byte via an unsafe cast, but the full hostname is still copied into the buffer. Outcome: causing heap memory corruption.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info