AISLE's AI-assisted security audit identified 24 vulnerabilities in the curl library across two versions This article explores vulnerabilities curl. . The findings include issues related to credential leakage, authentication boundaries, protocol command injection, and persistent security state.

These included stale AWS Signature Version 4 headers reaching unintended destinations, Negotiate authentication crossing redirected origins, and host credentials leaking to HTTP proxies. Other findings involved SFTP or SCP redirects bypassing host verification, FTP connection reuse inheriting client certificates, automatic client-certificate selection becoming confused during reuse, and passwords appearing through CURLINFO_EFFECTIVE_URL. Together, these issues highlight how legitimate features can undermine authentication when destination changes, connection pooling, and identity settings interact.

First batch of findings (Source: aisle) Rather than requiring an obvious parser failure, the vulnerable behavior emerges when previously trusted state persists beyond its intended boundary. CVE-2026-87864 provides a concrete example of protocol-level command injection. When CURLOPT_CRLF is enabled during an IMAP APPEND operation, curl reports the original input length but sends data expanded through line-ending conversion.

Additionally, AISLE reported cookie-handling flaws that could erase cookie-jar contents or interrupt loading, as well as HSTS persistence weaknesses that could discard entries. Further findings affected FTP callbacks, TFTP transfer direction, and the command-line no-clobber guarantee when processing HTTP 103 Early Hints. Two additional issues concerned availability: a missing server response triggered an endless loop, and recursive curl_mime_free operations exhausted the stack.