| {"static": {"score": {"reports": 197, "slop_auto_closed": "24/49", "slop_auto_closed_pct": 49.0, "real_wrongly_closed": "0/148", "real_kept_pct": 100.0, "slop_closed_or_low": "40/49", "real_closed_or_low": "7/148", "verdicts": {"slop": {"FABRICATED": 8, "NOT_REPRODUCED": 16, "PLAUSIBLE": 25}, "real": {"PLAUSIBLE": 148}}, "avg_usd": 0.1443, "avg_seconds": 85.9, "wrongly_closed_ids": [], "missed_slop_ids": ["3101127", "3100073", "3125832", "2912277", "2905552", "3158093", "3137657", "3231321", "3230082", "3249936", "3400831", "3250490", "3403880", "3452725", "3395227", "3399774", "3462525", "3465094", "3468410", "3459636", "3506159", "3514263", "3473182", "3470095", "3516186"]}, "rows": [{"id": "2823554", "label": "slop", "title": "Buffer overflow in strcpy", "created_at": "2024-11-06T01:50:15.925Z", "verdict": "FABRICATED", "priority": null, "confidence": 0.95, "headline": "Report claims a curl strcpy() buffer overflow with RCE, but the stack trace shows OpenSSL functions, curl's strcpy sites are all bounds-checked, and the POC is a generic exploit template unrelated to curl.", "repro_outcome": null, "usd": 0.05239, "seconds": 33.6, "provider": "nebius", "investigated": false}, {"id": "2199174", "label": "slop", "title": "[Critical] Curl CVE-2023-38545 vulnerability code changes are disclosed on the internet", "created_at": "2023-10-10T04:25:20.591Z", "verdict": "FABRICATED", "priority": null, "confidence": 0.95, "headline": "The report invents a fake integer-overflow vulnerability in curl_easy_setopt() and a non-existent fix; the real CVE-2023-38545 is a heap overflow in SOCKS5 proxy handling.", "repro_outcome": null, "usd": 0.06387, "seconds": 40.1, "provider": "nebius", "investigated": false}, {"id": "2819666", "label": "slop", "title": "Exploitable Format String Vulnerability in curl_mfprintf Function", "created_at": "2024-11-04T16:32:35.237Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.9, "headline": "The curl_mfprintf function is a standard printf-like variadic wrapper; the reported vulnerability is a caller-side misuse, not a library bug.", "repro_outcome": null, "usd": 0.0275, "seconds": 31.1, "provider": "nebius", "investigated": false}, {"id": "2298307", "label": "slop", "title": "Buffer Overflow Vulnerability in WebSocket Handling", "created_at": "2023-12-28T06:55:53.765Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The reported buffer overflow cannot occur because the WebSocket nonce is internally generated (16 random bytes), base64-encoded to a fixed 24-character string, and explicitly bounds-checked against a 40-byte destination buffer before the strcpy call.", "repro_outcome": null, "usd": 0.06135, "seconds": 30.9, "provider": "nebius", "investigated": false}, {"id": "2981245", "label": "slop", "title": "(\"possible\") UAF", "created_at": "2025-02-07T20:54:16.947Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.92, "headline": "The reported UAF pattern does not exist in libcurl's actual code; both callers of cf_h2_proxy_ctx_free either return immediately or nullify the owning pointer after free.", "repro_outcome": null, "usd": 0.05749, "seconds": 41.8, "provider": "nebius", "investigated": false}, {"id": "2887487", "label": "slop", "title": "Buffer Overflow Risk in Curl_inet_ntop and inet_ntop4", "created_at": "2024-12-08T07:15:38.929Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The reported buffer overflow does not exist: both inet_ntop4 and inet_ntop6 perform runtime size checks before strcpy, and the reporter's own PoC code includes the same check that would return ENOSPC instead of overflowing.", "repro_outcome": null, "usd": 0.04689, "seconds": 32.5, "provider": "nebius", "investigated": false}, {"id": "2871792", "label": "slop", "title": "Buffer Overflow Vulnerability in strcpy() Leading to Remote Code Execution", "created_at": "2024-11-30T20:42:31.156Z", "verdict": "FABRICATED", "priority": null, "confidence": 0.95, "headline": "The report claims a strcpy() buffer overflow in curl but the stack trace points to OpenSSL's libcrypto and all curl strcpy() calls are bounds-checked or use correctly sized allocations.", "repro_outcome": null, "usd": 0.04449, "seconds": 27.7, "provider": "nebius", "investigated": false}, {"id": "3116935", "label": "slop", "title": "Use of a Broken or Risky Cryptographic Algorithm (CWE-327) in libcurl", "created_at": "2025-04-29T07:42:35.530Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.9, "headline": "DES usage in NTLMv1 is protocol-mandated, not a libcurl vulnerability; libcurl already prefers NTLMv2 (HMAC-MD5) when available.", "repro_outcome": null, "usd": 0.03562, "seconds": 24.8, "provider": "nebius", "investigated": false}, {"id": "3125820", "label": "slop", "title": "HTTP/2 CONTINUATION Flood Vulnerability", "created_at": "2025-05-04T04:10:47.115Z", "verdict": "FABRICATED", "priority": null, "confidence": 0.92, "headline": "The report invents a non-existent function `http2_handle_continuation` and a code snippet not present in libcurl, while misattributing CVE-2023-44487 (Rapid Reset) to a different vulnerability class.", "repro_outcome": null, "usd": 0.03537, "seconds": 30.0, "provider": "nebius", "investigated": false}, {"id": "3117697", "label": "slop", "title": "Double Free Vulnerability in `libcurl` Cookie Management (`cookie.c`)", "created_at": "2025-04-29T10:50:02.405Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.9, "headline": "Static analysis shows neither claimed double-free exists: replace_existing frees the old cookie exactly once, and Curl_cookie_add frees the new cookie only at a single fail label.", "repro_outcome": null, "usd": 0.09829, "seconds": 58.4, "provider": "nebius", "investigated": false}, {"id": "3101127", "label": "slop", "title": "Buffer Overflow in curl MQTT Test Server (tests/server/mqttd.c) via Malicious CONNECT Packet", "created_at": "2025-04-19T20:20:05.462Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.65, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] Reporter's code snippet matches mqttd.c at line 527, but the full CONNECT packet parsing logic and subsequent use of the password length are not in the provided source excerpt; reproduction not attempted.", "repro_outcome": null, "usd": 0.09666, "seconds": 54.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05891, "tavily_credits": 0}, {"id": "3100073", "label": "slop", "title": "Path Traversal Vulnerability in curl via Unsanitized IPFS_PATH Environment Variable", "created_at": "2025-04-18T17:41:17.969Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.9, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] IPFS_PATH environment variable in curl allows path traversal and file content leakage via DNS error messages in ipfs:// URL handling.", "repro_outcome": null, "usd": 0.15294, "seconds": 78.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05942, "tavily_credits": 0}, {"id": "3125832", "label": "slop", "title": "HTTP/3 Stream Dependency Cycle Exploit", "created_at": "2025-05-04T04:56:30.714Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.55, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] Report describes a cyclic HTTP/3 PRIORITY_UPDATE attack against curl 8.13.0, but the claimed vulnerable function (ngtcp2_http3_handle_priority_frame) and its recursion logic are not present in the provided curl source tree \u2014 they would reside in the ngtcp2/nghttp3 library, which was not fully supplied.", "repro_outcome": null, "usd": 0.10388, "seconds": 68.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06761, "tavily_credits": 0}, {"id": "2912277", "label": "slop", "title": "Hackers Attack Curl Vulnerability Accessing Sensitive Information", "created_at": "2024-12-23T06:24:30.519Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "The report describes CVE-2024-11053 (netrc credential leak on redirect), a real vulnerability fixed in curl 8.12.0; static analysis confirms the logic flaw exists in the code at the reported commit, though no sandbox reproduction was run.", "repro_outcome": null, "usd": 0.17521, "seconds": 105.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06997, "tavily_credits": 1}, {"id": "2905552", "label": "slop", "title": "bypass of this Fixed #2437131 [ Inadequate Protocol Restriction Enforcement in curl ]", "created_at": "2024-12-18T04:33:49.429Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.6, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] Report claims --proto restriction bypass; claimed functions and code quotes are fabricated, but core logic issue (empty protocol string interpretation) is unverified and a similar historical issue exists.", "repro_outcome": null, "usd": 0.1727, "seconds": 99.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10083, "tavily_credits": 0}, {"id": "3242005", "label": "slop", "title": "Use-After-Free in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurl", "created_at": "2025-07-09T03:04:29.345Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.9, "headline": "The reported UAF is a self-inflicted error in the test program, not a libcurl vulnerability; libcurl frees SSL objects only after handshake completion when OpenSSL will no longer invoke the keylog callback.", "repro_outcome": null, "usd": 0.05412, "seconds": 49.5, "provider": "nebius", "investigated": false}, {"id": "3158093", "label": "slop", "title": "Memory Leak in libcurl via Location Header Handling (CWE-770)", "created_at": "2025-05-22T01:15:43.536Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.85, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] Memory leak confirmed in code: Location header allocated in http_header but never freed in Curl_req_hard_reset or Curl_req_free, leaking on each redirect.", "repro_outcome": null, "usd": 0.14219, "seconds": 71.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.09641, "tavily_credits": 1}, {"id": "3137657", "label": "slop", "title": "Memory Leak", "created_at": "2025-05-09T20:18:25.908Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.9, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] Memory leak confirmed in getparameter() C_HELP case: direct strdup() into global->help_category at line 2754 is never freed; getstr() is not involved but the leak is real.", "repro_outcome": null, "usd": 0.17337, "seconds": 84.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10948, "tavily_credits": 3}, {"id": "3293884", "label": "slop", "title": "Vulnerability Report: Local File Disclosure via file:// Protocol in cURL", "created_at": "2025-08-10T20:24:50.847Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The file:// protocol in cURL works as designed per RFC 1738; reading /etc/shadow via sudo curl is expected OS behavior, not a cURL vulnerability.", "repro_outcome": null, "usd": 0.04184, "seconds": 163.5, "provider": "nebius", "investigated": false}, {"id": "3231321", "label": "slop", "title": "HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb Tunneling", "created_at": "2025-07-01T12:47:43.690Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.65, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] Report describes a plausible CONNECT-tunneling bypass via CURLOPT_CUSTOMREQUEST on http:// URLs; setopt stores the verb unchecked and CLI helper does not block it, but the HTTP request-building and tunnel-decision logic in lib/http.c has not been verified in the provided snippets.", "repro_outcome": null, "usd": 0.18449, "seconds": 94.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.1099, "tavily_credits": 0}, {"id": "3295650", "label": "slop", "title": "Exposure of Hard-coded Private Keys and Credentials in curl Source Repository (CWE-321)", "created_at": "2025-08-12T08:28:19.519Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.9, "headline": "The two files cited as containing hard-coded secrets (tests/data/testprivkey.pem and docs/examples/http-auth-example.txt) do not exist in the curl repository at the analyzed commit, and the quoted private key material is not present anywhere in the codebase.", "repro_outcome": null, "usd": 0.03931, "seconds": 186.2, "provider": "nebius", "investigated": false}, {"id": "3340109", "label": "slop", "title": "Stack Buffer Overflow in cURL Cookie Parsing Leads to RCE", "created_at": "2025-09-16T07:59:31.123Z", "verdict": "FABRICATED", "priority": null, "confidence": 0.99, "headline": "The reported stack buffer overflow exists only in the reporter's self-written PoC, not in cURL's actual cookie parsing code; the ASan trace points to the PoC's own function, and the cited source files do not exist in the project.", "repro_outcome": null, "usd": 0.08845, "seconds": 56.9, "provider": "nebius", "investigated": false}, {"id": "3335085", "label": "slop", "title": "TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation Bypass", "created_at": "2025-09-11T15:02:42.727Z", "verdict": "FABRICATED", "priority": null, "confidence": 0.92, "headline": "The report recycles CVE-2023-32001 (fixed in libcurl 8.2.0) as a new vulnerability in 8.16.0, invents non-existent functions, and its PoC demonstrates correct TLS connection reuse rather than a bypass.", "repro_outcome": null, "usd": 0.0637, "seconds": 64.9, "provider": "nebius", "investigated": false}, {"id": "3392174", "label": "slop", "title": "Buffer Overflow in WebSocket Handshake (lib/ws.c:1287)", "created_at": "2025-10-21T07:39:27.203Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The claimed buffer overflow cannot occur: the source data is 16 locally-generated random bytes that base64-encode to exactly 24 characters, the destination is 40 bytes, and an explicit bounds check aborts if the encoded length ever reached 40 (which is mathematically impossible).", "repro_outcome": null, "usd": 0.04152, "seconds": 31.8, "provider": "nebius", "investigated": false}, {"id": "3395218", "label": "slop", "title": "Use of Deprecated strcpy() with Fixed-Size Buffers in Progress Time Formatting", "created_at": "2025-10-22T21:13:31.196Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The claimed buffer overflow in time2str() does not exist; the 9-byte string \"--:--:--\" fits safely in the 10-byte caller buffers with one byte of margin.", "repro_outcome": null, "usd": 0.03942, "seconds": 25.8, "provider": "nebius", "investigated": false}, {"id": "3230082", "label": "slop", "title": "Stack-based Buffer Overflow in TELNET NEW_ENV Option Handling", "created_at": "2025-06-30T12:10:49.256Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.95, "headline": "[Low priority: a related bug was fixed before, so this may be a bypass; reproduce before closing] The reported stack overflow in TELNET NEW_ENV handling does not exist in the current code; the length check correctly accounts for all bytes written by both comma and non-comma branches.", "repro_outcome": null, "usd": 0.14782, "seconds": 114.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.07525, "tavily_credits": 0}, {"id": "3249936", "label": "slop", "title": "HTTP Request Smuggling Vulnerability Analysis - cURL Security Report", "created_at": "2025-07-13T13:42:11.154Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.75, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] cURL sends both Transfer-Encoding and Content-Length headers when the user supplies both, violating RFC 7230 \u00a73.3.3, but the project treats this as user responsibility rather than a client vulnerability.", "repro_outcome": null, "usd": 0.16871, "seconds": 79.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10336, "tavily_credits": 0}, {"id": "3400831", "label": "slop", "title": "CURLX_SET_BINMODE(NULL) can call fileno(NULL) and cause undefined behavior / crash", "created_at": "2025-10-27T06:55:04.051Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "CURLX_SET_BINMODE macro in lib/curlx/binmode.h lacks a NULL guard and expands to _fileno(stream) unguarded, so a NULL argument invokes fileno(NULL) \u2014 undefined behavior per POSIX.", "repro_outcome": null, "usd": 0.09213, "seconds": 61.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05069, "tavily_credits": 0}, {"id": "3250490", "label": "slop", "title": "Disk Space Exhaustion leading to a Denial of Service (DoS)", "created_at": "2025-07-14T02:20:06.105Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.9, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] The trace logging functions tool_debug_cb and dump write unbounded data to disk when --trace/--trace-ascii/--trace-bin are used, and attacker-controlled servers can stream unlimited body data through verified call paths (Curl_debug, ossl_trace), but no sandbox reproduction was executed.", "repro_outcome": null, "usd": 0.17055, "seconds": 245.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12719, "tavily_credits": 0}, {"id": "3418528", "label": "slop", "title": "Unsafe use of strcpy in Curl_ldap_err2string (packages/OS400/os400sys.c) \u2014 stack-buffer-overflow (PoC + ASan)", "created_at": "2025-11-10T13:36:42.725Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.92, "headline": "The reported function Curl_ldap_err2string does not exist; the three strcpy calls cited are in different helper functions and are size-matched by a preceding strlen, making overflow impossible.", "repro_outcome": null, "usd": 0.04787, "seconds": 33.5, "provider": "nebius", "investigated": false}, {"id": "3346118", "label": "slop", "title": "Timing Attack Vulnerability in curl Digest Authentication via Non-Constant-Time String Comparison", "created_at": "2025-09-18T16:11:20.710Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The strcmp at digest.c:360 compares a server-supplied algorithm string against a constant; no secret is involved, so no timing attack vulnerability exists at this location.", "repro_outcome": null, "usd": 0.16328, "seconds": 110.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.07218, "tavily_credits": 0}, {"id": "3418646", "label": "slop", "title": "Arbitrary Configuration File Inclusion: via External Control of File Name or Path", "created_at": "2025-11-10T15:55:21.053Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The report describes curl's documented --config feature working as designed, not a vulnerability; the user explicitly supplies the config file path and the options within it are standard curl capabilities.", "repro_outcome": null, "usd": 0.03955, "seconds": 33.8, "provider": "nebius", "investigated": false}, {"id": "3403880", "label": "slop", "title": "Logical Flaw in curl_url_set Leads to Inconsistent Query Parameter Encoding", "created_at": "2025-10-29T10:51:20.103Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.95, "headline": "[Not yet reproduced] curl_url_set() inconsistently encodes '=' in query strings: replace+encode encodes all '=', append+encode preserves first '=', proven by PoC against libcurl 8.5.0.", "repro_outcome": null, "usd": 0.09352, "seconds": 51.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04362, "tavily_credits": 0}, {"id": "3272982", "label": "slop", "title": "Vulnerability Report: Public Exposure of Security Audit File", "created_at": "2025-07-26T21:18:06.517Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The Cure53 audit report was intentionally published in August 2016 as part of a Secure Open Source audit program, not accidentally leaked; the claimed information-disclosure vulnerability does not exist.", "repro_outcome": null, "usd": 0.16588, "seconds": 97.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.13667, "tavily_credits": 8}, {"id": "3452725", "label": "slop", "title": "Title: Use-After-Free in cURL Test Suite via Improper Cleanup of Global Handle", "created_at": "2025-12-05T08:09:14.389Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.55, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] Test code in lib1555.c shows a use-after-free pattern (global handle freed but not nulled), but exploitability depends on unconfirmed test-harness behavior and mitigation checks in curl_easy_recv/send.", "repro_outcome": null, "usd": 0.09761, "seconds": 52.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05852, "tavily_credits": 0}, {"id": "3395227", "label": "slop", "title": "Use of Deprecated strcpy() with User-Controlled Environment Variable in Memory Debug Initialization", "created_at": "2025-10-22T21:30:38.225Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.95, "headline": "[Low priority: the code reading rules the claim out but the text screen finds it credible; reproduce before closing] The claimed buffer overflow cannot occur because the code explicitly truncates the input to \u2264511 bytes before the strcpy into a 512-byte buffer, and the function is only compiled in debug builds.", "repro_outcome": null, "usd": 0.18345, "seconds": 107.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.13744, "tavily_credits": 2}, {"id": "3399774", "label": "slop", "title": "Integer Overflow to Heap Overflow in DoH Response Handling", "created_at": "2025-10-25T20:12:34.215Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.9, "headline": "[Low priority: the code reading rules the claim out but the text screen finds it credible; reproduce before closing] The integer overflow in doh_probe_write_cb cannot be triggered by any real network input because libcurl invokes write callbacks with bounded chunk sizes (size=1, nmemb=chunk_len) and dynbuf enforces a toobig limit that fails cleanly before any overflow could occur.", "repro_outcome": null, "usd": 0.22609, "seconds": 154.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.12479, "tavily_credits": 0}, {"id": "3466883", "label": "slop", "title": "Curl Alt-Svc Parser Stack Buffer Overflow", "created_at": "2025-12-16T04:46:33.492Z", "verdict": "FABRICATED", "priority": null, "confidence": 0.92, "headline": "Report invents non-existent functions (Curl_dyn_ptr, Curl_dyn_len) and a memcpy pattern that does not exist in the codebase; actual Alt-Svc parsing uses curlx_str_quotedword() which enforces length limits.", "repro_outcome": null, "usd": 0.09234, "seconds": 47.7, "provider": "nebius", "investigated": false}, {"id": "3462525", "label": "slop", "title": "Buffer Overflow in cURL Internal printf Function", "created_at": "2025-12-12T04:24:35.869Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.7, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] curl_msprintf() lacks bounds checking exactly as reported, but whether internal cURL callers expose this to attackers is unconfirmed.", "repro_outcome": null, "usd": 0.09147, "seconds": 60.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.03413, "tavily_credits": 0}, {"id": "3465094", "label": "slop", "title": "Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path Normalization", "created_at": "2025-12-15T07:45:05.932Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.92, "headline": "Path traversal bypass via URL-encoded slashes in file:// URLs is confirmed by code analysis; sandbox reproduction was not run but the logic trace is complete and the unit test proves the bypass.", "repro_outcome": null, "usd": 0.15903, "seconds": 73.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10549, "tavily_credits": 0}, {"id": "3468410", "label": "slop", "title": "Heap buffer overflow in Curl_ipv4_resolve_r due to incorrect buffer alignment and size calculation on AmigaOS", "created_at": "2025-12-17T05:44:02.316Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.6, "headline": "Heap buffer overflow claimed in AmigaOS DNS resolver due to alignment/padding mismatch, but AmigaOS-specific type definitions and library contract are missing from the source tree provided.", "repro_outcome": null, "usd": 0.09007, "seconds": 60.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05809, "tavily_credits": 1}, {"id": "3459636", "label": "slop", "title": "Stack Buffer Overflow in cURL wolfSSL Backend (lib/vtls/wolfssl.c)", "created_at": "2025-12-09T18:59:59.101Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.95, "headline": "[Low priority: the code reading rules the claim out but the text screen finds it credible; reproduce before closing] The reported stack buffer overflow in wssl_strerror is not reachable because the function is static and all callers pass 256-byte buffers.", "repro_outcome": null, "usd": 0.15456, "seconds": 92.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.11719, "tavily_credits": 2}, {"id": "3506159", "label": "slop", "title": "Heap Out-of-Bounds Read in lib/http2.c via Malformed PUSH_PROMISE Headers", "created_at": "2026-01-10T19:22:25.801Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "The on_header callback in lib/http2.c uses %s format specifiers on nghttp2 header pointers that are not guaranteed null-terminated, causing a heap out-of-bounds read via strlen in curl_maprintf.", "repro_outcome": null, "usd": 0.0978, "seconds": 56.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05232, "tavily_credits": 0}, {"id": "3514263", "label": "slop", "title": "libcurl: Improper Authentication State Management on Cross-Protocol Redirects", "created_at": "2026-01-17T07:52:01.656Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Report describes CVE-2025-14524 (bearer token leak on cross-protocol redirect); code pattern matches at lib/http.c:1254, CVE confirmed by SUSE advisory, but sandbox reproduction was not run.", "repro_outcome": null, "usd": 0.16946, "seconds": 89.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07075, "tavily_credits": 0}, {"id": "3516202", "label": "slop", "title": "Cookie Replacement Use-After-Free Vulnerability", "created_at": "2026-01-19T10:27:16.208Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The claimed use-after-free at lib/cookie.c:915 does not exist; the code reads repl->creationtime before freeing the cookie, not after.", "repro_outcome": null, "usd": 0.04494, "seconds": 46.4, "provider": "nebius", "investigated": false}, {"id": "3466896", "label": "slop", "title": "Heap Overflow in cURL AmigaOS Socket Implementation", "created_at": "2025-12-16T05:15:25.354Z", "verdict": "FABRICATED", "priority": null, "confidence": 0.85, "headline": "The report's core code quote does not exist in the codebase; the actual AmigaOS implementation passes correct buffer pointer and length to gethostbyname_r.", "repro_outcome": null, "usd": 0.1456, "seconds": 96.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.08549, "tavily_credits": 0}, {"id": "3473182", "label": "slop", "title": "A logic error in detect_proxy caused truncation of environment variable names for long protocol schemes.", "created_at": "2025-12-20T06:19:17.734Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "The detect_proxy function uses a 20-byte buffer for scheme+'_proxy', truncating schemes longer than 13 chars; the code currently shows this flaw, but exploitability depends on whether a >13-char scheme can be registered and reach this path.", "repro_outcome": null, "usd": 0.16191, "seconds": 93.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.11205, "tavily_credits": 2}, {"id": "3470095", "label": "slop", "title": "Heap Buffer Over-Read via Malicious SMB Server READ_ANDX Response", "created_at": "2025-12-18T11:38:42.997Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.65, "headline": "Report describes a real bounds-check gap in smb_request_state() where attacker-controlled offsets are validated only against total bytes received (smbc->got), but whether this reaches uninitialized heap depends on buffer management not fully visible in the provided snippets.", "repro_outcome": null, "usd": 0.27301, "seconds": 155.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10483, "tavily_credits": 0}, {"id": "3516186", "label": "slop", "title": "Cookie Max-Age Integer Overflow Vulnerability", "created_at": "2026-01-19T10:12:12.195Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.95, "headline": "[Low priority: the code reading rules the claim out but the text screen finds it credible; reproduce before closing] The claimed integer overflow in cookie Max-Age parsing cannot occur; the overflow check is mathematically sound and multiple independent bounds cap cookie expiration.", "repro_outcome": null, "usd": 0.20756, "seconds": 112.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.10781, "tavily_credits": 0}, {"id": "1045844", "label": "real", "title": "FTP wildcard stack overflow", "created_at": "2020-11-27T22:59:28.374Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Recursive wc_statemach in lib/ftp.c creates unbounded stack depth when processing FTP directory listings with many non-file entries; GitHub issue #6255 corroborates the crash.", "repro_outcome": null, "usd": 0.11813, "seconds": 66.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05898, "tavily_credits": 0}, {"id": "1040166", "label": "real", "title": "trusting FTP PASV responses", "created_at": "2020-11-21T13:57:43.758Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Code confirms curl defaults to using the IP/port from the FTP PASV response, enabling SSRF-driven port scanning when an attacker controls the URL; CURLOPT_FTP_SKIP_PASV_IP mitigates but is off by default.", "repro_outcome": null, "usd": 0.11952, "seconds": 76.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.062, "tavily_credits": 0}, {"id": "1048457", "label": "real", "title": "Inferior OCSP verification", "created_at": "2020-12-01T20:53:56.493Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Static analysis shows cURL's OCSP stapling verification in lib/vtls/openssl.c does not match the peer certificate's serial number against the OCSP response, allowing a valid response for a different same-issuer certificate to be accepted.", "repro_outcome": null, "usd": 0.13666, "seconds": 71.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.102, "tavily_credits": 0}, {"id": "1172857", "label": "real", "title": "schannel cipher selection surprise", "created_at": "2021-04-22T22:39:18.170Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Static algIds array in set_ssl_ciphers causes per-connection cipher lists to be overwritten by the last configuration.", "repro_outcome": null, "usd": 0.10296, "seconds": 62.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07406, "tavily_credits": 0}, {"id": "1213175", "label": "real", "title": "Wrong content via metalink not discarded", "created_at": "2021-05-30T20:49:36.999Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "curl's --metalink hash validation reports failure but leaves the mismatched file on disk because post_per_transfer does not delete the file or propagate an error code.", "repro_outcome": null, "usd": 0.1278, "seconds": 78.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07452, "tavily_credits": 1}, {"id": "1129529", "label": "real", "title": "TLS 1.3 session ticket proxy host mixup", "created_at": "2021-03-17T18:30:33.904Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "TLS 1.3 session tickets from an HTTPS proxy are mis-filed under the destination hostname because CONNECT_PROXY_SSL() returns false after the proxy handshake completes, causing curl to offer the proxy's ticket to the destination server.", "repro_outcome": null, "usd": 0.16275, "seconds": 75.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.1165, "tavily_credits": 0}, {"id": "1101882", "label": "real", "title": "Automatic referer leaks credentials", "created_at": "2021-02-12T01:08:34.999Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "The `--referer ';auto'` feature copies the full URL (including user:pass and #fragment) into the Referer header on redirects, contrary to the Referrer-Policy spec; the code path is real and a fix using curl's URL API is provided.", "repro_outcome": null, "usd": 0.17302, "seconds": 77.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.13523, "tavily_credits": 4}, {"id": "1213181", "label": "real", "title": "Metalink download sends credentials", "created_at": "2021-05-30T21:32:16.923Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Metalink transfers reuse original --user credentials for all subsequent URLs without host/protocol boundary checks, unlike HTTP redirects which require --location-trusted.", "repro_outcome": null, "usd": 0.11362, "seconds": 81.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05143, "tavily_credits": 0}, {"id": "1180380", "label": "real", "title": "TLS session caching disaster", "created_at": "2021-04-29T20:31:01.285Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.6, "headline": "Stale SSL ex_data pointers on connection detach/attach create a use-after-free pattern, but the critical connection-cache-reuse path with a new Curl_easy is not confirmed in the provided code.", "repro_outcome": null, "usd": 0.21499, "seconds": 104.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12726, "tavily_credits": 2}, {"id": "1234760", "label": "real", "title": "CURLOPT_SSLCERT mixup with Secure Transport", "created_at": "2021-06-15T15:39:06.658Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.6, "headline": "Report claims Secure Transport backend allows local file to override keychain certificate nickname, causing DoS; critical certificate-loading code not in provided snippets.", "repro_outcome": null, "usd": 0.12932, "seconds": 70.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10221, "tavily_credits": 0}, {"id": "1223565", "label": "real", "title": "Bad connection reuse due to flawed path name checks", "created_at": "2021-06-11T03:47:23.868Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Static analysis confirms four flaws in Curl_ssl_config_matches: missing issuercert_blob and issuercert comparisons, case-insensitive path/fingerprint comparisons; both callers (connection reuse and session reuse) directly use the flawed function.", "repro_outcome": null, "usd": 0.19472, "seconds": 97.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.11531, "tavily_credits": 1}, {"id": "1223882", "label": "real", "title": "TELNET stack contents disclosure again", "created_at": "2021-06-11T12:15:31.808Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "The fix for CVE-2021-22898 in curl 7.77.0 addresses long variable names but leaves a length-tracking bug when NEW_ENV has a short name and long value, causing uninitialized stack memory to be sent.", "repro_outcome": null, "usd": 0.0988, "seconds": 85.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.0563, "tavily_credits": 0}, {"id": "1334111", "label": "real", "title": "Protocol downgrade required TLS bypassed", "created_at": "2021-09-09T00:34:37.934Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Static analysis confirms three protocol downgrade paths where server responses bypass mandatory TLS (--ssl-reqd) in IMAP, POP3, and FTP; reproduction not run.", "repro_outcome": null, "usd": 0.07721, "seconds": 56.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04877, "tavily_credits": 0}, {"id": "1269242", "label": "real", "title": "UAF and double-free in MQTT sending", "created_at": "2021-07-19T18:20:56.555Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "The code in mqtt_doing frees mq->sendleftovers without NULLing the pointer or zeroing mq->nsend, creating a clear use-after-free and double-free path if mqtt_doing is re-entered with stale state after a successful retry.", "repro_outcome": null, "usd": 0.16143, "seconds": 89.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.09902, "tavily_credits": 0}, {"id": "1526328", "label": "real", "title": "OAUTH2 bearer bypass in connection re-use", "created_at": "2022-03-30T12:47:16.155Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "OAUTH2 bearer token not checked during connection reuse for SASL protocols, allowing cached authenticated connections to be reused with different bearer tokens.", "repro_outcome": null, "usd": 0.14834, "seconds": 69.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08979, "tavily_credits": 0}, {"id": "1176461", "label": "real", "title": "TELNET stack contents disclosure", "created_at": "2021-04-27T09:49:43.213Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.92, "headline": "[Low priority: the code reading rules the claim out but the text screen finds it credible; reproduce before closing] The claimed stack disclosure via uninitialized gaps is impossible: varval is initialized to an empty string and the buffer advance logic causes overrun, not gaps; the reproducer also never triggers the buggy sscanf==1 path.", "repro_outcome": null, "usd": 0.25176, "seconds": 165.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.1738, "tavily_credits": 1}, {"id": "1543773", "label": "real", "title": "Credential leak on redirect", "created_at": "2022-04-18T19:36:47.046Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Report describes CVE-2022-27774 (credential leak on HTTP-to-FTP redirect), fixed in curl 7.83.0; the code at report date (pre-7.83.0) is affected.", "repro_outcome": null, "usd": 0.12241, "seconds": 73.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08818, "tavily_credits": 0}, {"id": "1553301", "label": "real", "title": "cookie for trailing dot TLD", "created_at": "2022-04-28T08:30:28.110Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "The report describes a plausible bypass of the CVE-2014-3620 TLD cookie restriction using trailing dots (e.g., .me.), supported by code analysis showing bad_domain() accepts domains with a dot and tailmatch() aligns trailing dots between cookie domain and request host.", "repro_outcome": null, "usd": 0.09949, "seconds": 61.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.02695, "tavily_credits": 0}, {"id": "1547048", "label": "real", "title": "Auth/cookie leak on redirect ", "created_at": "2022-04-21T15:20:43.908Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Curl leaks Authorization/Cookie headers on HTTPS\u2192HTTP same-host redirect with port change due to missing protocol/port check in header suppression logic.", "repro_outcome": null, "usd": 0.14459, "seconds": 103.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.03987, "tavily_credits": 0}, {"id": "1546268", "label": "real", "title": "Bad local IPv6 connection reuse", "created_at": "2022-04-21T03:28:28.374Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Curl's connection cache key omits IPv6 zone ID, so connections to the same address with different interface scopes (e.g., %lo) are incorrectly reused.", "repro_outcome": null, "usd": 0.14471, "seconds": 66.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.0723, "tavily_credits": 0}, {"id": "1553598", "label": "real", "title": "curl removes wrong file on error", "created_at": "2022-04-28T12:58:26.679Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "curl's --no-clobber and --remove-on-error flags interact incorrectly: on error, the original filename is unlinked instead of the no-clobber generated filename, causing data loss.", "repro_outcome": null, "usd": 0.11126, "seconds": 54.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07467, "tavily_credits": 0}, {"id": "1334763", "label": "real", "title": "STARTTLS protocol injection via MITM", "created_at": "2021-09-09T14:00:44.703Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "STARTTLS pipeline injection appears plausible in curl's IMAP/POP3/SMTP clients; cached trailing data from the STARTTLS response is replayed after TLS upgrade without validation.", "repro_outcome": null, "usd": 0.21392, "seconds": 131.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12005, "tavily_credits": 2}, {"id": "1555441", "label": "real", "title": "CERTINFO never-ending busy-loop", "created_at": "2022-04-30T19:24:14.187Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "The certinfo certificate-chain traversal in lib/vtls/nss.c has no cycle detection; a malicious server presenting a looped CA chain (CA1\u2192CA2\u2192CA1) can cause an infinite loop in both the counting and extraction loops when CURLOPT_CERTINFO is enabled and NSS is the TLS backend.", "repro_outcome": null, "usd": 0.07426, "seconds": 58.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.03696, "tavily_credits": 0}, {"id": "1557449", "label": "real", "title": "HSTS bypass via trailing dot", "created_at": "2022-05-03T09:03:34.537Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Report describes CVE-2022-30115 (HSTS bypass via trailing dot), a real vulnerability fixed in curl 7.83.1; the report date (2022-05-03) falls within the affected version range (7.82.0\u20137.83.0), but the provided code snippets do not include the HSTS lookup path to confirm the bug in this specific commit.", "repro_outcome": null, "usd": 0.08727, "seconds": 57.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.03815, "tavily_credits": 0}, {"id": "1553841", "label": "real", "title": "percent-encoded path separator in URL host", "created_at": "2022-04-28T17:26:19.588Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.6, "headline": "curl URL-decodes percent-encoded slashes in the proxy host, creating a parser discrepancy with RFC3986, but the claimed SSRF bypass depends on non-standard resolver behavior and the report conflates proxy/target URLs.", "repro_outcome": null, "usd": 0.17495, "seconds": 129.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04591, "tavily_credits": 0}, {"id": "1569946", "label": "real", "title": "Set-Cookie denial of service", "created_at": "2022-05-13T19:53:49.142Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Code review confirms no per-domain cookie limit; an attacker can send many Set-Cookie headers with a shared Domain attribute to exceed the request-header ceiling and trigger CURLE_OUT_OF_MEMORY.", "repro_outcome": null, "usd": 0.14872, "seconds": 81.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07144, "tavily_credits": 0}, {"id": "1555796", "label": "real", "title": "TLS and SSH connection too eager reuse", "created_at": "2022-05-01T14:44:23.904Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.7, "headline": "Report claims curl reuses TLS connections across different SSL security options (CURLOPT_SSL_OPTIONS, CURLOPT_CRLFILE) without session invalidation; connection cache logic not in provided code but ssl_prefs_check confirms it only checks SSL version, not these options.", "repro_outcome": null, "usd": 0.1576, "seconds": 90.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.09858, "tavily_credits": 0}, {"id": "1590071", "label": "real", "title": "FTP-KRB bad message verification", "created_at": "2022-06-02T20:12:35.145Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "[Not yet reproduced] libcurl's krb5_decode returns -1 on gss_unwrap failure; read_data assigns it to size_t buf->size without checking, causing heap over-read in buffer_read and potential FTP response injection via '599 ' prefix.", "repro_outcome": null, "usd": 0.09804, "seconds": 65.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04596, "tavily_credits": 1}, {"id": "1570651", "label": "real", "title": "HTTP compression denial of service", "created_at": "2022-05-15T01:56:48.774Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Static analysis confirms three header-processing paths (Transfer-Encoding, Content-Encoding, Set-Cookie) allocate memory per header/encoding without any global limit, enabling unbounded memory consumption until OOM.", "repro_outcome": null, "usd": 0.175, "seconds": 84.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10873, "tavily_credits": 0}, {"id": "1573634", "label": "real", "title": "Unpreserved file permissions", "created_at": "2022-05-17T17:28:53.876Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Curl does not preserve file permissions when writing cookie-jar and alt-svc databases, widening access from 0600 to 0644 (umask 022) and replacing symlinks; HSTS database file not found in source tree.", "repro_outcome": null, "usd": 0.15958, "seconds": 75.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.09348, "tavily_credits": 0}, {"id": "1721098", "label": "real", "title": ".netrc parser out-of-bounds access", "created_at": "2022-10-03T16:14:04.112Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "The .netrc parser in lib/netrc.c has two loops that lack bounds checks and can read/write past the buffer when a .netrc file contains no whitespace characters.", "repro_outcome": null, "usd": 0.09722, "seconds": 56.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05974, "tavily_credits": 0}, {"id": "1704017", "label": "real", "title": "POST following PUT confusion", "created_at": "2022-09-18T23:27:44.853Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "CURLOPT_POST fails to override CURLOPT_UPLOAD's PUT method, causing second request to send PUT with prior read buffer instead of POST with POSTFIELDS \u2014 confirmed by GitHub issue #9507 but not sandbox-reproduced.", "repro_outcome": null, "usd": 0.11827, "seconds": 62.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08352, "tavily_credits": 0}, {"id": "1613943", "label": "real", "title": "control code in cookie denial of service", "created_at": "2022-06-26T08:46:53.961Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Static analysis confirms curl stores control characters (e.g., form feed) from Set-Cookie headers verbatim and emits them unsanitized in Cookie request headers, which strict servers like Apache reject with 400 Bad Request, causing persistent DoS for the poisoned cookie jar.", "repro_outcome": null, "usd": 0.15587, "seconds": 81.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.1069, "tavily_credits": 0}, {"id": "1730660", "label": "real", "title": "HSTS bypass via IDN", "created_at": "2022-10-11T16:30:22.558Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Static analysis confirms HSTS lookup occurs before IDN conversion in the reported commit, allowing U+3002 and similar characters to bypass HSTS; this matches CVE-2022-43551 fixed in curl 7.87.0.", "repro_outcome": null, "usd": 0.13894, "seconds": 82.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08617, "tavily_credits": 0}, {"id": "1722065", "label": "real", "title": "HTTP proxy double-free", "created_at": "2022-10-04T15:34:57.518Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Valgrind trace and static analysis show a deterministic double-free of the HTTP proxy connect_state when using an HTTP proxy with dict:// protocol, but the sandbox did not run the reproduction.", "repro_outcome": null, "usd": 0.18683, "seconds": 102.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08678, "tavily_credits": 0}, {"id": "1764858", "label": "real", "title": "HTTP Proxy deny use-after-free", "created_at": "2022-11-07T16:45:50.217Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.65, "headline": "Use-after-free plausible in HTTP proxy CONNECT for telnet/smb with crafted hostnames, but not reproduced and ownership semantics around hyper_executor_poll and connection teardown are unclear.", "repro_outcome": null, "usd": 0.13365, "seconds": 95.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04675, "tavily_credits": 0}, {"id": "1755083", "label": "real", "title": "Another HSTS bypass via IDN", "created_at": "2022-10-29T16:45:01.597Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "The HSTS cache stores the pre-IDN hostname while lookups use the post-IDN hostname, allowing a bypass when an IDN character normalizes to '.'.", "repro_outcome": null, "usd": 0.11574, "seconds": 79.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07244, "tavily_credits": 0}, {"id": "1826048", "label": "real", "title": "HTTP multi-header compression denial of service", "created_at": "2023-01-08T12:34:31.598Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.6, "headline": "Report claims unbounded memory allocation via multiple Content-Encoding/Transfer-Encoding headers; code shows per-header limit but call pattern for regular responses is unverified.", "repro_outcome": null, "usd": 0.0674, "seconds": 57.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.03502, "tavily_credits": 0}, {"id": "1891474", "label": "real", "title": "Telnet option IAC injection", "created_at": "2023-03-03T19:13:41.218Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Static analysis confirms user-supplied TTYPE, XDISPLOC, and NEW_ENV values are stored and sent without IAC (0xff) escaping, allowing telnet command injection via CURLOPT_TELNETOPTIONS.", "repro_outcome": null, "usd": 0.15582, "seconds": 71.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.11229, "tavily_credits": 0}, {"id": "1813864", "label": "real", "title": "curl HSTS ignored on multiple requests", "created_at": "2022-12-21T09:59:15.331Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.75, "headline": "curl HSTS state not persisted between multiple requests in a single invocation, causing the second request to use HTTP even after the first receives an HSTS header", "repro_outcome": null, "usd": 0.20414, "seconds": 125.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.14187, "tavily_credits": 6}, {"id": "1814333", "label": "real", "title": "HSTS amnesia with --parallel", "created_at": "2022-12-21T12:48:23.786Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "The report describes CVE-2023-23915 (HSTS amnesia with --parallel), a known vulnerability fixed in curl 7.88.0; static analysis of the cited commit confirms the bug exists in that code.", "repro_outcome": null, "usd": 0.20742, "seconds": 111.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.15655, "tavily_credits": 6}, {"id": "1892780", "label": "real", "title": "FTP too eager connection reuse", "created_at": "2023-03-05T21:25:18.291Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.7, "headline": "FTP connection reuse may ignore CURLOPT_FTP_ACCOUNT and CURLOPT_FTP_ALTERNATIVE_TO_USER, but the connection cache matching logic was not in the provided code snippets.", "repro_outcome": null, "usd": 0.14248, "seconds": 69.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10772, "tavily_credits": 0}, {"id": "1913733", "label": "real", "title": "UAF in SSH sha256 fingerprint check", "created_at": "2023-03-21T12:05:28.374Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.95, "headline": "Use-after-free in ssh_check_fingerprint: fingerprint_b64 is freed then passed to failf() on mismatch path.", "repro_outcome": null, "usd": 0.05763, "seconds": 28.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.02566, "tavily_credits": 0}, {"id": "1892351", "label": "real", "title": "SFTP path ~ resolving discrepancy", "created_at": "2023-03-05T02:08:44.770Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Static analysis confirms the SFTP branch of Curl_getworkingpath expands any '/~' prefix to the home directory, not just '/~/' as documented, enabling path traversal via '/~a../...' sequences.", "repro_outcome": null, "usd": 0.13151, "seconds": 77.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.09745, "tavily_credits": 1}, {"id": "1898475", "label": "real", "title": "SSH connection too eager reuse still", "created_at": "2023-03-09T18:09:38.068Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "SSH connection reuse check uses == against a bitmask, so it never matches; the bug is in lib/url.c ConnectionExists, not lib/ws.c.", "repro_outcome": null, "usd": 0.08362, "seconds": 49.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04579, "tavily_credits": 0}, {"id": "1895135", "label": "real", "title": "GSS delegation too eager connection re-use", "created_at": "2023-03-07T11:00:18.994Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Connection reuse logic omits CURLOPT_GSSAPI_DELEGATION comparison, potentially allowing a connection established with delegation=\"always\" to be reused for a request requiring delegation=\"none\".", "repro_outcome": null, "usd": 0.12053, "seconds": 61.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08823, "tavily_credits": 0}, {"id": "1897203", "label": "real", "title": "HSTS double-free", "created_at": "2023-03-08T18:10:27.746Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "HSTS parsing and expiration cleanup modify a shared linked list and free entries without acquiring the CURL_LOCK_DATA_HSTS lock, creating a clear race condition for double-free or use-after-free under concurrent access.", "repro_outcome": null, "usd": 0.15149, "seconds": 62.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.11177, "tavily_credits": 0}, {"id": "1929597", "label": "real", "title": "siglongjmp race condition", "created_at": "2023-04-02T01:19:19.253Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Race condition confirmed in USE_ALARM_TIMEOUT codepath: global curl_jmpenv accessed concurrently without locking, causing siglongjmp to jump to wrong thread context.", "repro_outcome": null, "usd": 0.14628, "seconds": 57.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10338, "tavily_credits": 1}, {"id": "1954658", "label": "real", "title": "more POST-after-PUT confusion", "created_at": "2023-04-19T13:43:09.446Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.75, "headline": "The report claims CURLOPT_POSTFIELDS (and related options) do not clear the stale upload flag left by a prior PUT, so a reused easy handle sends PUT instead of POST; static analysis of lib/setopt.c supports this, but no sandbox run has confirmed the behavior and the project documentation states the opposite.", "repro_outcome": null, "usd": 0.12671, "seconds": 52.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08273, "tavily_credits": 0}, {"id": "2212193", "label": "real", "title": "cookie mixed case PSL bypass", "created_at": "2023-10-16T18:28:56.686Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Report describes CVE-2023-46218 (cookie mixed-case PSL bypass), a real vulnerability fixed in curl 7.88.0; the provided code snippets are consistent with the bug but the PSL call site was not visible in the excerpts.", "repro_outcome": null, "usd": 0.11735, "seconds": 65.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05129, "tavily_credits": 0}, {"id": "1950627", "label": "real", "title": "IDN wildcard match", "created_at": "2023-04-17T16:54:15.242Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "The hostmatch function checks the certificate pattern for 'xn--' instead of the hostname, allowing wildcard certificates to incorrectly match IDN hostnames per RFC 6125 \u00a76.4.3.", "repro_outcome": null, "usd": 0.16796, "seconds": 73.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.13337, "tavily_credits": 3}, {"id": "2236133", "label": "real", "title": "HSTS long file name clears contents", "created_at": "2023-11-02T00:51:08.247Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.95, "headline": "[Low priority: the code reading rules the claim out but the text screen finds it credible; reproduce before closing] The claimed vulnerability path is impossible in the current code: Curl_fopen fails at open() when the temporary filename exceeds filesystem limits, so the HSTS save block never runs and the original file is never modified.", "repro_outcome": null, "usd": 0.2002, "seconds": 98.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.04984, "tavily_credits": 0}, {"id": "2148242", "label": "real", "title": "cookie injection with none file", "created_at": "2023-09-14T14:58:50.358Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Cookie injection via curl_easy_duphandle when a file named 'none' exists in CWD \u2014 static analysis confirms the logic chain, but no sandbox reproduction was run.", "repro_outcome": null, "usd": 0.12972, "seconds": 80.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.0903, "tavily_credits": 1}, {"id": "2298922", "label": "real", "title": "OCSP verification bypass with TLS session reuse", "created_at": "2023-12-29T02:22:16.531Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.7, "headline": "Commit 7cf0391b added a condition that skips OCSP stapling verification during TLS session reuse, consistent with the report, but the test site is unreachable and session-resumption code paths were not fully traced in the provided source.", "repro_outcome": null, "usd": 0.12178, "seconds": 48.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08034, "tavily_credits": 0}, {"id": "2187833", "label": "real", "title": "socks5 heap buffer overflow", "created_at": "2023-09-30T08:26:30.836Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.6, "headline": "Report describes CVE-2023-38545 concept but cites incorrect function names and code snippets not found in the codebase; human verification needed.", "repro_outcome": null, "usd": 0.26547, "seconds": 111.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.1512, "tavily_credits": 1}, {"id": "2072338", "label": "real", "title": "HTTP header allocation DOS", "created_at": "2023-07-17T12:43:20.202Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.95, "headline": "[Low priority: a related bug was fixed before, so this may be a bypass; reproduce before closing] curl enforces a 100KB hard limit (CURL_MAX_HTTP_HEADER) on the total HTTP header buffer, so a malicious server streaming unlimited headers hits CURLE_OUT_OF_MEMORY at ~100KB rather than exhausting system resources.", "repro_outcome": null, "usd": 0.17114, "seconds": 91.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.11442, "tavily_credits": 1}, {"id": "2402845", "label": "real", "title": "HTTP/2 push headers memory-leak", "created_at": "2024-03-05T16:56:33.495Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Memory leak in HTTP/2 PUSH_PROMISE header handling: two error paths in on_header free the push_headers array pointer but not the individual header strings, allowing a malicious server to exhaust memory.", "repro_outcome": null, "usd": 0.09007, "seconds": 48.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04434, "tavily_credits": 0}, {"id": "2410774", "label": "real", "title": "QUIC certificate check bypass with wolfSSL", "created_at": "2024-03-10T21:32:06.332Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "QUIC WolfSSL backend can bypass certificate verification when ctx_setup succeeds and a later init step fails.", "repro_outcome": null, "usd": 0.15238, "seconds": 76.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05982, "tavily_credits": 0}, {"id": "2384833", "label": "real", "title": "Usage of disabled protocol", "created_at": "2024-02-21T19:56:12.005Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.75, "headline": "The CLI parser emits an empty string for `--proto -all,-http`; if libcurl treats that as \"all protocols allowed\" the bug is real, and a matching known issue exists (#10997).", "repro_outcome": null, "usd": 0.13822, "seconds": 56.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.09421, "tavily_credits": 0}, {"id": "2669852", "label": "real", "title": "OCSP stapling bypass with GnuTLS", "created_at": "2024-08-19T17:31:44.551Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Inverted condition in curl's GnuTLS OCSP stapling verification causes any non-revoked response (including UNAUTHORIZED/UNKNOWN) to be treated as success, bypassing revocation checks.", "repro_outcome": null, "usd": 0.08715, "seconds": 46.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.03939, "tavily_credits": 0}, {"id": "2416725", "label": "real", "title": "TLS certificate check bypass with mbedTLS", "created_at": "2024-03-14T11:49:49.229Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "curl with mbedTLS skips certificate hostname verification when connecting via IP address because mbedtls_ssl_set_hostname is only called when SNI is configured, and SNI is not set for IP addresses.", "repro_outcome": null, "usd": 0.15375, "seconds": 68.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08462, "tavily_credits": 0}, {"id": "2629968", "label": "real", "title": "ASN.1 date parser overread", "created_at": "2024-07-30T05:16:36.481Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "ASN.1 GeneralizedTime parser can overread via fracl=-1 when fractional seconds are absent; reporter's ASan report shows crash, code analysis confirms mechanism, multiple TLS backends expose it to attacker-controlled certificates.", "repro_outcome": null, "usd": 0.2048, "seconds": 101.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07238, "tavily_credits": 0}, {"id": "2764830", "label": "real", "title": "HSTS subdomain overwrites parent cache entry", "created_at": "2024-10-07T16:58:58.995Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "curl's HSTS cache loading logic incorrectly merges subdomain entries into parent entries, causing parent expiration times to be overwritten with child values when includeSubDomains is set.", "repro_outcome": null, "usd": 0.22903, "seconds": 118.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07799, "tavily_credits": 0}, {"id": "2559516", "label": "real", "title": "freeing stack buffer in utf8asn1str", "created_at": "2024-06-18T23:00:06.739Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "The function utf8asn1str() calls free() on a stack-allocated buffer (char buf[4]) when processing a malicious TLS certificate, which is undefined behavior and reachable during certinfo extraction.", "repro_outcome": null, "usd": 0.19801, "seconds": 93.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12766, "tavily_credits": 2}, {"id": "2829063", "label": "real", "title": "netrc + redirect credential leak", "created_at": "2024-11-08T01:10:50.236Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Code analysis supports netrc credential leak during redirects when the redirect target's netrc entry omits password or both login and password, causing fallback to the previous host's credentials.", "repro_outcome": null, "usd": 0.22312, "seconds": 119.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07746, "tavily_credits": 0}, {"id": "2954286", "label": "real", "title": "eventfd double close", "created_at": "2025-01-22T19:38:46.786Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.85, "headline": "[Low priority: references look wrong, but nothing rules the claim out yet] Report cites non-existent files (lib/eventfd.c, lib/urldata.c) and a GitHub issue that contains no vulnerability description; code analysis shows no double-close in the actual wakeup cleanup path.", "repro_outcome": null, "usd": 0.18518, "seconds": 101.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10529, "tavily_credits": 1}, {"id": "2917232", "label": "real", "title": "netrc and default credential leak", "created_at": "2024-12-30T16:02:18.567Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.65, "headline": "The report describes a plausible bypass of the CVE-2024-11053 fix in netrc credential handling, but the critical parsing logic is not fully visible in the provided code and no reproduction was run.", "repro_outcome": null, "usd": 0.18119, "seconds": 132.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08839, "tavily_credits": 0}, {"id": "2604391", "label": "real", "title": "macidn punycode buffer overread", "created_at": "2024-07-16T02:07:09.459Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.7, "headline": "Report describes a plausible stack-buffer overread in the Apple IDN backend (mac_idn_to_ascii) when ICU's uidna_nameToASCII_UTF8 fills the 256-byte buffer exactly, leaving it non-NUL-terminated; the code path exists only when built with USE_APPLE_IDN and has not been reproduced or verified against the actual source at the cited commit.", "repro_outcome": null, "usd": 0.2746, "seconds": 214.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.18327, "tavily_credits": 11}, {"id": "3153497", "label": "real", "title": "No QUIC certificate pinning with wolfSSL", "created_at": "2025-05-19T16:01:54.031Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.7, "headline": "Certificate pinning may be bypassed for HTTP/3 (QUIC) with wolfSSL because the QUIC handshake path likely does not call wssl_verify_pinned().", "repro_outcome": null, "usd": 0.09825, "seconds": 54.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06829, "tavily_credits": 0}, {"id": "2956023", "label": "real", "title": "gzip integer overflow", "created_at": "2025-01-23T23:37:03.914Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Integer overflow in z->avail_in during gzip header parsing (zlib < 1.2.0.4 path) allows heap corruption via buffer shrinkage, OOB memcpy, and free of forged chunk; code matches report exactly but sandbox reproduction not run.", "repro_outcome": null, "usd": 0.21327, "seconds": 108.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.11433, "tavily_credits": 0}, {"id": "3150884", "label": "real", "title": "QUIC certificate check skip with wolfSSL", "created_at": "2025-05-17T06:01:26.574Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "WolfSSL QUIC certificate verification skips CN/SAN check for IP addresses because it only runs when peer->sni is set, but sni is NULL for IP connections.", "repro_outcome": null, "usd": 0.11757, "seconds": 69.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05331, "tavily_credits": 0}, {"id": "3330839", "label": "real", "title": "predictable WebSocket mask", "created_at": "2025-09-08T09:52:13.904Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "curl's WebSocket client generates a single masking key at connection upgrade and reuses it for every frame, violating RFC 6455 \u00a75.3 which requires a fresh unpredictable key per frame.", "repro_outcome": null, "usd": 0.10529, "seconds": 62.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04171, "tavily_credits": 0}, {"id": "3294999", "label": "real", "title": "Out of bounds read for cookie path", "created_at": "2025-08-11T16:28:29.715Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.95, "headline": "[Not yet reproduced] Out-of-bounds read in replace_existing when existing secure cookie has empty path (spath=\"\") and a non-secure cookie overwrites it; reproduced by AddressSanitizer at lib/cookie.c:977.", "repro_outcome": null, "usd": 0.17333, "seconds": 73.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.09377, "tavily_credits": 0}, {"id": "3168039", "label": "real", "title": "WebSocket endless loop", "created_at": "2025-05-30T03:38:19.322Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Infinite loop in curl_ws_send() reachable when auto-pong recursively sends a PONG frame while an outer fragmented frame is in progress, leaving encoder state corrupted so a subsequent OFFSET call enters a zero-payload loop.", "repro_outcome": null, "usd": 0.23866, "seconds": 175.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.11486, "tavily_credits": 0}, {"id": "3459417", "label": "real", "title": "bearer token leak on cross-protocol redirect", "created_at": "2025-12-09T18:01:03.640Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.75, "headline": "Bearer token not cleared on cross-protocol redirect in libcurl, despite CVE-2022-27776 claiming to fix this exact issue", "repro_outcome": null, "usd": 0.18714, "seconds": 107.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10692, "tavily_credits": 0}, {"id": "3477116", "label": "real", "title": "libssh global knownhost override ", "created_at": "2025-12-24T04:45:21.545Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "curl's CURLOPT_SSH_KNOWNHOSTS does not disable libssh's global knownhosts fallback, allowing /etc/ssh/ssh_known_hosts to override an empty user file.", "repro_outcome": null, "usd": 0.14377, "seconds": 72.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10394, "tavily_credits": 0}, {"id": "3355218", "label": "real", "title": "missing SFTP host verification with wolfSSH", "created_at": "2025-09-23T15:14:16.228Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.92, "headline": "The wolfSSH backend's SFTP implementation lacks server host key verification code paths and does not expose --ssh-knownhosts or --hostpubsha256 options, leaving connections vulnerable to MITM.", "repro_outcome": null, "usd": 0.17624, "seconds": 136.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12314, "tavily_credits": 0}, {"id": "3480925", "label": "real", "title": "libssh key passphrase bypass without agent set", "created_at": "2025-12-28T21:22:56.665Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "libcurl's libssh v1 backend calls ssh_userauth_publickey_auto without checking CURLSSH_AUTH_AGENT, allowing ssh-agent to satisfy publickey auth even when only CURLSSH_AUTH_PUBLICKEY is set.", "repro_outcome": null, "usd": 0.16399, "seconds": 77.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12985, "tavily_credits": 4}, {"id": "3591944", "label": "real", "title": "use after free in SMB connection reuse", "created_at": "2026-03-08T11:32:38.070Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Connection reuse in SMB leaves easy handle's req->path pointing into freed needle connection memory, causing UAF at strlen(req->path) in smb_send_open.", "repro_outcome": null, "usd": 0.13921, "seconds": 71.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06737, "tavily_credits": 0}, {"id": "3584903", "label": "real", "title": "wrong proxy connection reuse with credentials", "created_at": "2026-03-04T13:29:05.562Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "libcurl HTTP proxy CONNECT tunnel reuse ignores proxy credentials in shared connection cache, allowing auth bypass", "repro_outcome": null, "usd": 0.18058, "seconds": 75.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.14133, "tavily_credits": 5}, {"id": "3583983", "label": "real", "title": "token leak with redirect and netrc", "created_at": "2026-03-03T22:21:02.246Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "The netrc bypass at lib/http.c:822 allows OAuth2 bearer tokens to leak to redirect targets when --netrc is used, because the HTTP bearer path lacks the host check that the SASL fix (CVE-2025-14524) added for the SASL path.", "repro_outcome": null, "usd": 0.22444, "seconds": 92.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.13934, "tavily_credits": 1}, {"id": "3642555", "label": "real", "title": "wrong reuse of HTTP Negotiate connection", "created_at": "2026-04-01T15:36:23.858Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Code analysis confirms the logic bug: NTLM tentative match sets m->found and returns FALSE, skipping the Negotiate check, and url_match_result ignores the FALSE result to attach the connection.", "repro_outcome": null, "usd": 0.19221, "seconds": 81.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.11233, "tavily_credits": 0}, {"id": "3650689", "label": "real", "title": "wrong reuse of SMB connection", "created_at": "2026-04-05T10:42:42.384Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Code evidence confirms SMB connection reuse lacks share validation in url_match_proto_config, enabling cross-share data spoofing; sandbox reproduction not run but logic is sound.", "repro_outcome": null, "usd": 0.10782, "seconds": 55.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05258, "tavily_credits": 0}, {"id": "3677759", "label": "real", "title": "netrc credential leak with reused proxy connection", "created_at": "2026-04-16T11:28:15.733Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "libcurl leaks .netrc Authorization credentials across redirected hosts when an HTTP proxy connection is reused, because host changes during redirect don't trigger credential clearing when the proxy endpoint stays the same.", "repro_outcome": null, "usd": 0.11407, "seconds": 82.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.02934, "tavily_credits": 0}, {"id": "3671818", "label": "real", "title": "stale custom cookie host causes cookie leak", "created_at": "2026-04-14T05:45:10.893Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Stale cookiehost persists across requests on a reused easy handle, diverting cookie selection and Set-Cookie attribution to a previous custom Host value.", "repro_outcome": null, "usd": 0.12861, "seconds": 69.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06631, "tavily_credits": 0}, {"id": "3621851", "label": "real", "title": "connection reuse ignores TLS requirement", "created_at": "2026-03-22T23:14:15.066Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Connection reuse logic for cleartext-upgrade mail protocols (IMAP, POP3, SMTP) does not honor CURLOPT_USE_SSL/--ssl-reqd, allowing a plaintext connection to be reused for a transfer that requires STARTTLS.", "repro_outcome": null, "usd": 0.17469, "seconds": 115.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.09315, "tavily_credits": 0}, {"id": "3694390", "label": "real", "title": "OCSP stapling bypass with Apple SecTrust", "created_at": "2026-04-25T00:11:18.898Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "OCSP stapling enforcement is silently bypassed when Apple SecTrust verifies the certificate chain because the verifystatus() call is guarded by !sectrust_verified, but SecTrust uses a best-effort revocation policy and receives no OCSP response when the server doesn't staple.", "repro_outcome": null, "usd": 0.18099, "seconds": 80.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10111, "tavily_credits": 0}, {"id": "3669637", "label": "real", "title": "proxy credentials leak over redirect-to proxy", "created_at": "2026-04-13T10:02:42.759Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Proxy credentials leak across redirect-induced proxy re-selection (HTTP\u2192HTTPS) because Curl_http_follow clears only regular auth, not per-transfer proxy auth.", "repro_outcome": null, "usd": 0.20482, "seconds": 111.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12275, "tavily_credits": 0}, {"id": "3721183", "label": "real", "title": "wrong reuse for different services", "created_at": "2026-05-08T15:31:07.570Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Code analysis confirms HTTP Negotiate connection reuse logic omits service-name comparison, allowing a connection authenticated for one service principal to be reused for another on the same host.", "repro_outcome": null, "usd": 0.13241, "seconds": 63.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05836, "tavily_credits": 0}, {"id": "3718195", "label": "real", "title": "wrong STARTTLS connection reuse", "created_at": "2026-05-07T06:58:50.126Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "STARTTLS connection reuse bypasses SSL config verification for IMAP/POP3/SMTP/FTP/LDAP because url_match_ssl_config is gated on PROTOPT_SSL which these schemes lack, and url_match_ssl_use permits reuse via PROTOPT_SSL_REUSE before config comparison.", "repro_outcome": null, "usd": 0.14063, "seconds": 83.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.0722, "tavily_credits": 0}, {"id": "3733905", "label": "real", "title": "trailing dot domain super cookie", "created_at": "2026-05-13T21:30:47.215Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Static analysis confirms a trailing-dot hostname bypasses PSL public-suffix check in the HTTP redirect path; no sandbox run yet.", "repro_outcome": null, "usd": 0.07558, "seconds": 54.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.0313, "tavily_credits": 0}, {"id": "3733910", "label": "real", "title": "incomplete mTLS config matching in conn reuse", "created_at": "2026-05-13T21:34:53.862Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.6, "headline": "Report claims an incomplete CVE-2022-27782 fix where mTLS credential fields (KEYPASSWD, SSLKEY, etc.) are omitted from connection-reuse comparison, but the cited functions, file vtls_scache.c, and line numbers do not exist in the current codebase.", "repro_outcome": null, "usd": 0.09579, "seconds": 69.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04757, "tavily_credits": 0}, {"id": "3697719", "label": "real", "title": "cross-proxy Digest auth state leak", "created_at": "2026-04-27T02:54:12.273Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Cross-proxy Digest auth state leak confirmed in libcurl 8.19.0 code analysis; matches CVE-2026-7168 fixed in 8.20.0", "repro_outcome": null, "usd": 0.21991, "seconds": 108.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12189, "tavily_credits": 0}, {"id": "3735193", "label": "real", "title": "SASL double-free", "created_at": "2026-05-14T11:47:26.146Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.98, "headline": "[Not yet reproduced] Double-free in GSASL authentication path: Curl_auth_gsasl_is_supported() frees gsasl->ctx on probe failure without nulling the pointer, and Curl_auth_gsasl_cleanup() frees it again at connection teardown.", "repro_outcome": null, "usd": 0.12284, "seconds": 64.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06828, "tavily_credits": 0}, {"id": "3750295", "label": "real", "title": "stale proxy password leak", "created_at": "2026-05-20T10:49:36.468Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Code analysis confirms CURLOPT_PROXYUSERPWD setter retains stale proxy password when setting username-only or NULL values; PoC provided but not sandbox-reproduced.", "repro_outcome": null, "usd": 0.14083, "seconds": 73.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08322, "tavily_credits": 0}, {"id": "3735184", "label": "real", "title": "password leak with netrc and user in URL", "created_at": "2026-05-14T11:38:36.412Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.7, "headline": "Report describes a plausible .netrc username/password mismatch bug in Curl_parsenetrc; static analysis identifies a code path where a URL-supplied username (bob) is paired with a .netrc password for a different login (alice), but no sandbox reproduction has run.", "repro_outcome": null, "usd": 0.17227, "seconds": 82.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10082, "tavily_credits": 2}, {"id": "3751697", "label": "real", "title": "HTTP/2 stream-dependency tree UAF", "created_at": "2026-05-20T19:31:25.612Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "curl_easy_reset() clears HTTP/2 stream-dependency pointers without removing the handle from peers' trees, causing use-after-free when peers are later cleaned up.", "repro_outcome": null, "usd": 0.10736, "seconds": 48.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06866, "tavily_credits": 0}, {"id": "3749204", "label": "real", "title": "UAF after pause in socket callback", "created_at": "2026-05-19T22:04:22.921Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.92, "headline": "[Not yet reproduced] Heap-use-after-free in mev_sh_entry_update when curl_easy_pause() is called from a socket callback, because mev_assess lacks an in_callback guard and can free the entry before control returns.", "repro_outcome": null, "usd": 0.16951, "seconds": 99.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07302, "tavily_credits": 0}, {"id": "3751712", "label": "real", "title": "SSH improper host validation", "created_at": "2026-05-20T19:40:43.275Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "curl's libssh backend maps SSH_KNOWN_HOSTS_OTHER (documented by libssh as a possible attack) to CURLKHMATCH_MISSING, causing TOFU callbacks to accept keys they should reject.", "repro_outcome": null, "usd": 0.11108, "seconds": 57.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06811, "tavily_credits": 0}, {"id": "3754343", "label": "real", "title": "sending old referer", "created_at": "2026-05-22T03:13:05.737Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Static analysis confirms CURLOPT_REFERER=NULL fails to clear data->state.referer, causing stale Referer header emission and UAF on next transfer; PoC provided but not dynamically reproduced.", "repro_outcome": null, "usd": 0.12851, "seconds": 55.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04142, "tavily_credits": 0}, {"id": "3752888", "label": "real", "title": "exposing HTTP/3 early data", "created_at": "2026-05-21T10:57:57.074Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.95, "headline": "[Not yet reproduced] The ngtcp2 HTTP/3 backend sends request data as TLS early data before peer verification completes when reusing a cached session, allowing a MITM to capture sensitive request headers and body.", "repro_outcome": null, "usd": 0.16884, "seconds": 74.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08959, "tavily_credits": 0}, {"id": "3783438", "label": "real", "title": "QUIC zero-length UDP datagrams busy-loop", "created_at": "2026-06-05T03:49:59.586Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Zero-length UDP datagrams bypass packet budget in recvmmsg_packets() and recvmsg_packets(), allowing a malicious QUIC peer to block the event loop and bypass --max-time.", "repro_outcome": null, "usd": 0.14526, "seconds": 71.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08753, "tavily_credits": 0}, {"id": "3788984", "label": "real", "title": "Native CA trust persist", "created_at": "2026-06-08T08:24:56.214Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Native CA trust flag persists after switching to custom CA material on easy-handle reuse, confirmed by code logic and PoC; sandbox reproduction not run, end-to-end cert acceptance inferred.", "repro_outcome": null, "usd": 0.20441, "seconds": 83.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.14352, "tavily_credits": 1}, {"id": "3788931", "label": "real", "title": "WS Auto-PONG memory exhaustion", "created_at": "2026-06-08T07:54:48.687Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.92, "headline": "Static analysis confirms the auto-PONG queueing path allows unbounded memory growth under peer control; PoC provided but not executed in sandbox.", "repro_outcome": null, "usd": 0.21592, "seconds": 110.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12326, "tavily_credits": 1}, {"id": "3797526", "label": "real", "title": "proto-default skips SSH verification", "created_at": "2026-06-12T02:55:28.111Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.95, "headline": "[Not yet reproduced] curl silently ignores --hostpubsha256/--knownhosts when --proto-default sftp/scp is used with a schemeless URL, allowing credential disclosure to a MITM attacker.", "repro_outcome": null, "usd": 0.13057, "seconds": 67.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.08342, "tavily_credits": 0}, {"id": "3793260", "label": "real", "title": "cross-origin Digest auth state leak", "created_at": "2026-06-10T05:00:51.031Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Digest auth state (nonce, realm, nc counter) appears to persist across curl_easy_perform() calls because Curl_pretransfer() clears initial_origin but the provided code does not show data->state.digest being cleared.", "repro_outcome": null, "usd": 0.16861, "seconds": 82.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12146, "tavily_credits": 1}, {"id": "3923520", "label": "real", "title": "Negotiate ambient user conn reuse", "created_at": "2026-08-07T12:21:52.577Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Connection reuse logic in url_match_auth_nego() skips credential comparison when conn->creds is NULL, allowing ambient SSPI connections to be reused for explicit-credential requests.", "repro_outcome": null, "usd": 0.14151, "seconds": 87.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06957, "tavily_credits": 0}, {"id": "3744543", "label": "real", "title": "env-set cross-proxy Digest auth state leak", "created_at": "2026-05-18T11:47:15.139Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.78, "headline": "Stale Digest proxy-auth state may leak when switching proxies via environment variables on a reused handle; explicit CURLOPT_PROXY path was fixed in 8.20.0 (CVE-2026-7168) but env-var path unconfirmed.", "repro_outcome": null, "usd": 0.20032, "seconds": 325.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.11955, "tavily_credits": 0}, {"id": "3916059", "label": "real", "title": "HTTP/2 server push UAF", "created_at": "2026-08-04T15:44:52.562Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.95, "headline": "[Not yet reproduced] HTTP/2 server-pushed stream handle created via h2_duphandle/curl_easy_duphandle loses the parent's share pointer, causing the shared connection to be freed from the wrong connection pool and leaving a dangling pointer in share->cpool that is later read during curl_share_cleanup \u2014 a use-after-free confirmed by AddressSanitizer on the provided reproducer.", "repro_outcome": null, "usd": 0.23267, "seconds": 118.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12304, "tavily_credits": 0}, {"id": "3822248", "label": "real", "title": "OpenLDAP SASL authentication bypass", "created_at": "2026-06-24T08:36:36.503Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "OpenLDAP SASL state machine incorrectly treats SASL_IDLE as success, allowing authentication bypass via SASL_CANCEL injection; other SASL callers in the codebase handle this correctly.", "repro_outcome": null, "usd": 0.20466, "seconds": 96.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12356, "tavily_credits": 1}, {"id": "3972357", "label": "real", "title": "HSTS cache import drops longer-lived child", "created_at": "2026-08-26T22:33:52.777Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "HSTS cache import silently drops longer-lived includeSubDomains child when parent is loaded first, losing the child's policy after parent expiry.", "repro_outcome": null, "usd": 0.08951, "seconds": 110.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05241, "tavily_credits": 0}, {"id": "3969300", "label": "real", "title": "OpenSSL pinning bypass", "created_at": "2026-08-25T18:14:37.562Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "OpenSSL backend skips pinned-pubkey verification when CURLOPT_SSL_VERIFYPEER=0 (--insecure), allowing MITM to bypass pinning; static analysis confirms the logic bug in lib/vtls/openssl.c, though the report mislocates it in lib/ws.c and the PoC has not been sandbox-tested.", "repro_outcome": null, "usd": 0.18511, "seconds": 95.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.097, "tavily_credits": 0}, {"id": "3969368", "label": "real", "title": "native CA store conn reuse", "created_at": "2026-08-25T18:40:29.465Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.95, "headline": "[Low priority: the code reading rules the claim out but the text screen finds it credible; reproduce before closing] The report claims native_ca_store is not compared in match_ssl_primary_config, but the code at lib/vtls/vtls_config.c:144 explicitly compares c1->native_ca_store == c2->native_ca_store, preventing the described connection reuse.", "repro_outcome": null, "usd": 0.10931, "seconds": 74.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.06352, "tavily_credits": 0}, {"id": "3969255", "label": "real", "title": "OpenSSL provider use-after-free", "created_at": "2026-08-25T18:11:27.760Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.7, "headline": "Report describes a plausible lifetime mismatch between per-handle OSSL_LIB_CTX and pooled SSL_CTX, but critical code paths (SSL_CTX creation with embedded libctx, connection pooling retention, and reuse dereference) are not visible in the provided evidence.", "repro_outcome": null, "usd": 0.19379, "seconds": 109.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12274, "tavily_credits": 2}, {"id": "3972373", "label": "real", "title": "HSTS response erases persisted entries", "created_at": "2026-08-26T22:43:59.260Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "HSTS cache truncation and silent data loss when an HTTPS origin sends a max-age value that parses but exceeds struct tm's representable range, confirmed by static analysis of the code paths.", "repro_outcome": null, "usd": 0.13666, "seconds": 128.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.04981, "tavily_credits": 0}, {"id": "3972094", "label": "real", "title": "cross-origin reuse of a Negotiate connection", "created_at": "2026-08-26T20:23:40.391Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Cross-origin connection reuse via Negotiate-authenticated connection for NTLM request is plausible; the origin check in url_match_auth_ntlm is gated on conn->creds (NULL in this flow), so url_match_auth_nego never runs and url_match_result attaches the mismatched connection.", "repro_outcome": null, "usd": 0.23284, "seconds": 121.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.14307, "tavily_credits": 1}, {"id": "3972385", "label": "real", "title": "domain-scoped PSL domain cookie", "created_at": "2026-08-26T22:49:19.035Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "The report's logic bug claim holds against the current code: parse_domain() sets tailmatch=TRUE for explicit domains, and the PSL exact-match acceptance path in Curl_cookie_add() never clears it, so a Domain=github.io cookie leaks to attacker.github.io.", "repro_outcome": null, "usd": 0.11018, "seconds": 83.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06491, "tavily_credits": 1}, {"id": "3973176", "label": "real", "title": "redirect to SFTP or SCP bypasses host verification", "created_at": "2026-08-27T09:20:59.946Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "ssh_setopts() early return bypasses SSH host verification on HTTPS-to-SFTP redirects", "repro_outcome": null, "usd": 0.07355, "seconds": 37.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.03018, "tavily_credits": 0}, {"id": "3973090", "label": "real", "title": "wolfSSL CA-cache hit overrides callback", "created_at": "2026-08-27T08:28:10.963Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Static analysis confirms the logic bug: x509_store_setup flag is not set on CA cache hits, allowing cached store to overwrite CURLOPT_SSL_CTX_FUNCTION's replacement during handshake.", "repro_outcome": null, "usd": 0.13528, "seconds": 67.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05851, "tavily_credits": 0}, {"id": "3973135", "label": "real", "title": "stale SigV4 headers sent unintended", "created_at": "2026-08-27T09:03:09.766Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Setting CURLOPT_AWS_SIGV4 to NULL clears the parameter string but leaves the CURLAUTH_AWS_SIGV4 bit set in httpauth, causing stale SigV4 headers on reused handles.", "repro_outcome": null, "usd": 0.11182, "seconds": 56.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06956, "tavily_credits": 0}, {"id": "3972395", "label": "real", "title": "secure cookie attribute bypass with tab", "created_at": "2026-08-26T22:58:23.895Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.92, "headline": "The strparse-based cookie parser in lib/cookie.c fails to skip HTAB (0x09) as whitespace before attribute names, causing the Secure flag to be silently dropped and HTTPS-only cookies to leak over HTTP \u2014 a regression introduced in curl 8.13.0.", "repro_outcome": null, "usd": 0.15229, "seconds": 87.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07764, "tavily_credits": 0}, {"id": "3973201", "label": "real", "title": "server-set cookie erases cookie jar", "created_at": "2026-08-27T09:32:48.752Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Code analysis confirms a remote server can poison a shared Netscape cookie jar causing CURLE_TOO_LARGE on reload and destructive cleanup that erases all cookies.", "repro_outcome": null, "usd": 0.14992, "seconds": 95.5, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05086, "tavily_credits": 0}, {"id": "3975408", "label": "real", "title": "knownhost callback mismatches key as missing", "created_at": "2026-08-28T07:34:45.053Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.92, "headline": "[Low priority: the investigator verified evidence that the claim holds; reproduce before closing] The report quotes a vulnerable code block and a function (Curl_ssh_keycallback) that do not exist in the cited commit; line references also mismatch.", "repro_outcome": null, "usd": 0.17048, "seconds": 106.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10413, "tavily_credits": 0}, {"id": "3973190", "label": "real", "title": "FTP connection reuse inherits client-certificate", "created_at": "2026-08-27T09:26:06.486Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "FTP connection pooling allows a CURLUSESSL_NONE handle to inherit a prior handle's client certificate via a STARTTLS-upgraded control connection without a new TLS handshake or FTP login.", "repro_outcome": null, "usd": 0.22362, "seconds": 97.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.13779, "tavily_credits": 1}, {"id": "3989514", "label": "real", "title": "wolfSSL public-key pinning bypass", "created_at": "2026-09-02T07:42:42.308Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.75, "headline": "curl's wolfSSL backend passes raw peer-certificate DER to Curl_parseX509() without validation; the parser lacks bounds checks on the validity SEQUENCE, allowing a crafted certificate to make curl select a different SPKI than wolfSSL's handshake parser, but the PoC has not been executed in the sandbox.", "repro_outcome": null, "usd": 0.25006, "seconds": 181.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.11538, "tavily_credits": 0}, {"id": "3993549", "label": "real", "title": "Negotiate credentials sent to redirected origin", "created_at": "2026-09-03T14:58:15.754Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Code review confirms the logic bug: redirect URL userinfo sets creds without origin check, bypassing the cross-host guard in Curl_http_output_auth and causing Negotiate tokens to be sent to unintended hosts.", "repro_outcome": null, "usd": 0.17115, "seconds": 154.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07915, "tavily_credits": 1}, {"id": "3993870", "label": "real", "title": "auto client cert connection reuse mixup", "created_at": "2026-09-03T15:37:27.061Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "libcurl's connection cache matcher ignores the per-request auto_client_cert flag, allowing a cached Schannel connection with client certificate to be reused across redirects to a different origin.", "repro_outcome": null, "usd": 0.11479, "seconds": 79.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06395, "tavily_credits": 1}, {"id": "4021979", "label": "real", "title": "server-set cookie aborts cookie jar load", "created_at": "2026-09-11T15:41:26.001Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "A remote server can poison a shared cookie jar by sending a Set-Cookie header that passes input validation but serializes to a Netscape-format line exceeding the reload limit, causing all subsequent transfers using that jar to fail before any network I/O.", "repro_outcome": null, "usd": 0.16226, "seconds": 108.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06327, "tavily_credits": 0}, {"id": "4022003", "label": "real", "title": "never-ending loop via server response omission", "created_at": "2026-09-11T15:59:57.469Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Unbounded loop in Curl_pp_readresp() lacks timeout checks, allowing a malicious FTP/IMAP/POP3/SMTP server to defeat CURLOPT_TIMEOUT_MS and starve other handles on the same multi handle.", "repro_outcome": null, "usd": 0.23877, "seconds": 97.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.13183, "tavily_credits": 0}, {"id": "4022568", "label": "real", "title": "TFTP direction confusion", "created_at": "2026-09-11T18:33:14.291Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "TFTP state machine lacks direction checks for ACK/DATA events, allowing a malicious server to flip a download into upload mode and drain stale CURLOPT_READDATA.", "repro_outcome": null, "usd": 0.18824, "seconds": 83.1, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.09822, "tavily_credits": 0}, {"id": "3993566", "label": "real", "title": "leaking host credentials to HTTP proxy", "created_at": "2026-09-03T15:06:49.145Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Static analysis confirms the credential-leak logic exists in lib/http.c under different function names; the PoC demonstrates the exploit end-to-end, but sandbox reproduction was not run.", "repro_outcome": null, "usd": 0.2205, "seconds": 225.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12944, "tavily_credits": 0}, {"id": "4022070", "label": "real", "title": "FTP wildcard write callback mixup", "created_at": "2026-09-11T16:27:00.701Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.55, "headline": "Report describes a credible FTP wildcard state-restoration bug with duphandle/WRITEDATA-reuse escalation, but cited line numbers and code quotes do not match the provided codebase; maintainer must verify the logic in the actual source.", "repro_outcome": null, "usd": 0.2042, "seconds": 90.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.13771, "tavily_credits": 0}, {"id": "4024222", "label": "real", "title": "curl_mime_free stack overflow by recursion", "created_at": "2026-09-12T14:01:13.055Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.95, "headline": "The MIME cleanup path lacks recursion depth guards present in the read path, allowing stack overflow when freeing deeply nested structures built via the public API.", "repro_outcome": null, "usd": 0.20598, "seconds": 96.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12897, "tavily_credits": 0}, {"id": "4041053", "label": "real", "title": "password leak in CURLINFO_EFFECTIVE_URL", "created_at": "2026-09-18T19:55:50.637Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "A .netrc-sourced password injected into the live URL handle at login survives a same-host relative redirect and appears verbatim in CURLINFO_EFFECTIVE_URL, verbose output, and write-out variables.", "repro_outcome": null, "usd": 0.15486, "seconds": 80.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.07612, "tavily_credits": 0}, {"id": "4040551", "label": "real", "title": "Authorization: Negotiate sent to foreign origin", "created_at": "2026-09-18T17:12:19.921Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.92, "headline": "Code analysis confirms the logic bug: URL-parsed credentials from a redirect bypass the cross-host auth boundary for Negotiate, allowing a Kerberos ticket to be sent to an attacker-chosen host.", "repro_outcome": null, "usd": 0.20661, "seconds": 114.8, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.10723, "tavily_credits": 0}, {"id": "4099618", "label": "real", "title": "local interface connection reuse mixup", "created_at": "2026-10-09T05:21:56.598Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Connection reuse key omits prefixed CURLOPT_INTERFACE bindings (if!, host!, ifhost!), allowing silent source-address reuse across different bindings.", "repro_outcome": null, "usd": 0.1132, "seconds": 60.7, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06756, "tavily_credits": 1}, {"id": "4023192", "label": "real", "title": "-J no-clobber guarantee bypassed with 103 early hints", "created_at": "2026-09-12T00:58:45.638Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "The -J no-clobber guarantee can be bypassed via 103 Early Hints or early ETag headers when -i is used, because header display opens the URL-derived file in truncating mode before Content-Disposition is processed.", "repro_outcome": null, "usd": 0.20188, "seconds": 149.0, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12322, "tavily_credits": 0}, {"id": "4030333", "label": "real", "title": "HTTP/2 upload Use-After-Free", "created_at": "2026-09-15T01:21:40.543Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "HTTP/2 upload use-after-free via RST_STREAM retry path confirmed by static analysis; PoC provided but not sandbox-tested", "repro_outcome": null, "usd": 0.2453, "seconds": 133.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.14361, "tavily_credits": 0}, {"id": "550696", "label": "real", "title": "Heap Buffer Overflow at lib/tftp.c", "created_at": "2019-04-29T18:08:38.242Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Static analysis confirms heap buffer overflow in lib/tftp.c: state->blksize remains at default (512) while receive buffer is allocated with user-specified smaller size, causing recvfrom to overflow on first packet from malicious server.", "repro_outcome": null, "usd": 0.09466, "seconds": 63.4, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05445, "tavily_credits": 0}, {"id": "4099194", "label": "real", "title": "info leak uploading over WebSockets with GnuTLS", "created_at": "2026-10-09T00:11:23.091Z", "verdict": "PLAUSIBLE", "priority": "low", "confidence": 0.95, "headline": "[Low priority: the code reading rules the claim out but the text screen finds it credible; reproduce before closing] The reported out-of-bounds read in gtls_send() is prevented by an unconditional runtime bounds check that returns an error when gnutls_record_send() returns more bytes than provided.", "repro_outcome": null, "usd": 0.13841, "seconds": 104.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": true, "investigation_usd": 0.09075, "tavily_credits": 0}, {"id": "684603", "label": "real", "title": "Heap buffer overflow in TFTP when using small blksize", "created_at": "2019-08-29T15:52:19.164Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.75, "headline": "TFTP client uses requested blksize for EOF detection before receiving OACK, causing silent truncation when server ignores blksize option and sends default 512-byte blocks.", "repro_outcome": null, "usd": 0.10558, "seconds": 54.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.06767, "tavily_credits": 0}, {"id": "608577", "label": "real", "title": "Windows Privilege Escalation: Malicious OpenSSL Engine", "created_at": "2019-06-12T02:21:14.871Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "Evidence summary below.", "repro_outcome": null, "usd": 0.14379, "seconds": 89.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.09151, "tavily_credits": 0}, {"id": "547630", "label": "real", "title": "An integer overflow found in /lib/urlapi.c", "created_at": "2019-04-24T12:05:35.567Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Integer overflow in seturl() when urllen \u2265 2GB on 32-bit systems; code path from curl_url_set exists via parseurlandfillconn with no length check, but not reproduced in sandbox.", "repro_outcome": null, "usd": 0.20279, "seconds": 105.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12357, "tavily_credits": 2}, {"id": "887462", "label": "real", "title": "curl overwrite local file with -J", "created_at": "2020-05-30T13:08:39.175Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "curl -OJi allows server-controlled file overwrite via Content-Disposition header by combining an option-order bug with a rename-before-check bug.", "repro_outcome": null, "usd": 0.09862, "seconds": 80.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05459, "tavily_credits": 0}, {"id": "686823", "label": "real", "title": "krb5: double-free in read_data() after realloc() fail", "created_at": "2019-09-03T11:51:58.974Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.75, "headline": "read_data() leaves a dangling pointer in conn->in_buffer.data when Curl_saferealloc() fails, creating a double-free risk if teardown later frees that buffer; remote trigger via oversized length is plausible on 32-bit systems.", "repro_outcome": null, "usd": 0.0893, "seconds": 75.3, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.05217, "tavily_credits": 0}, {"id": "874778", "label": "real", "title": "Partial password leak over DNS on HTTP redirect", "created_at": "2020-05-15T09:14:00.772Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "curl leaks password portion after '@' in DNS queries when following relative HTTP redirects with credentials containing '@'.", "repro_outcome": null, "usd": 0.24082, "seconds": 138.9, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.12848, "tavily_credits": 0}, {"id": "948876", "label": "real", "title": "Connect-only connections can use the wrong connection", "created_at": "2020-07-31T20:57:36.135Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "A connect-only easy handle can send data to the wrong server after its connection ages out and the connection cache reuses the memory for a new connection to a different host.", "repro_outcome": null, "usd": 0.22523, "seconds": 131.2, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.1287, "tavily_credits": 0}, {"id": "3972403", "label": "real", "title": "IMAP APPEND plus CRLF conversion command injection", "created_at": "2026-08-26T23:03:30.632Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "IMAP APPEND with CURLOPT_CRLF sends more bytes than declared in the literal, allowing command injection \u2014 confirmed by code analysis, not yet reproduced in sandbox.", "repro_outcome": null, "usd": 0.18597, "seconds": 109.6, "provider": "nebius", "investigated": true, "first_verdict": "PLAUSIBLE", "redecided": false, "investigation_usd": 0.13146, "tavily_credits": 2}]}, "sandbox": {"score": {"reports": 27, "slop_auto_closed": "9/19", "slop_auto_closed_pct": 47.4, "real_wrongly_closed": "0/8", "real_kept_pct": 100.0, "slop_closed_or_low": "10/19", "real_closed_or_low": "0/8", "verdicts": {"slop": {"NOT_REPRODUCED": 9, "PLAUSIBLE": 10}, "real": {"CONFIRMED": 2, "PLAUSIBLE": 6}}, "avg_usd": 0.5864, "avg_seconds": 416.0, "wrongly_closed_ids": [], "missed_slop_ids": ["3400831", "3462525", "3468410", "3506159", "3514263", "3465094", "3473182", "3231321", "3403880", "3459636"]}, "rows": [{"id": "2298307", "label": "slop", "title": "Buffer Overflow Vulnerability in WebSocket Handling", "created_at": "2023-12-28T06:55:53.765Z", "verdict": "NOT_REPRODUCED", "confidence": 0.95, "headline": "The reported buffer overflow does not exist; lib/ws.c:581 is protected by an explicit bounds check at lines 578-580 and the nonce is locally generated, not attacker-controlled.", "repro_outcome": "not_reproduced", "usd": 0.34, "seconds": 232.5, "priority": null}, {"id": "2819666", "label": "slop", "title": "Exploitable Format String Vulnerability in curl_mfprintf Function", "created_at": "2024-11-04T16:32:35.237Z", "verdict": "NOT_REPRODUCED", "confidence": 0.95, "headline": "The reported format-string vulnerability in curl_mfprintf is not a bug in curl; the PoC demonstrates incorrect API usage (missing variadic arguments), and no internal call sites pass user-controlled format strings without matching arguments.", "repro_outcome": "not_reproduced", "usd": 0.40768, "seconds": 246.2, "priority": null}, {"id": "3117697", "label": "slop", "title": "Double Free Vulnerability in `libcurl` Cookie Management (`cookie.c`)", "created_at": "2025-04-29T10:50:02.405Z", "verdict": "NOT_REPRODUCED", "confidence": 0.85, "headline": "The reported double-free vulnerabilities do not exist in the current codebase; Case 1 shows correct ownership transfer, Case 2 code was unavailable for analysis, and both issues correspond to CVEs fixed in curl 8.0.1.", "repro_outcome": "inconclusive", "usd": 0.59272, "seconds": 2098.8, "priority": null}, {"id": "3400831", "label": "slop", "title": "CURLX_SET_BINMODE(NULL) can call fileno(NULL) and cause undefined behavior / crash", "created_at": "2025-10-27T06:55:04.051Z", "verdict": "PLAUSIBLE", "confidence": 0.65, "headline": "Report claims CURLX_SET_BINMODE(NULL) calls fileno(NULL) causing UB; cited file tool_binmode.h doesn't exist but macro exists in lib/curlx/binmode.h \u2014 reproduction inconclusive, core issue plausible.", "repro_outcome": "inconclusive", "usd": 0.30391, "seconds": 183.6, "priority": null}, {"id": "3462525", "label": "slop", "title": "Buffer Overflow in cURL Internal printf Function", "created_at": "2025-12-12T04:24:35.869Z", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "[Low priority: the text screen flags this as likely slop; checks found no proof either way] curl_msprintf() lacks bounds checking by design (like sprintf), but exploitability depends on unverified callers that pass fixed-size buffers with attacker-controlled format strings.", "repro_outcome": "inconclusive", "usd": 0.51553, "seconds": 210.1, "priority": "low"}, {"id": "3735184", "label": "real", "title": "password leak with netrc and user in URL", "created_at": "2026-05-14T11:38:36.412Z", "verdict": "CONFIRMED", "confidence": 0.95, "headline": "curl combines a URL-supplied username with a .netrc password for a different login on the same host, sending 'bob:secret' when .netrc only has credentials for 'alice'.", "repro_outcome": "reproduced", "usd": 0.3077, "seconds": 160.7, "priority": null}, {"id": "4023192", "label": "real", "title": "-J no-clobber guarantee bypassed with 103 early hints", "created_at": "2026-09-12T00:58:45.638Z", "verdict": "PLAUSIBLE", "confidence": 0.75, "headline": "Detailed report with PoC claims -J no-clobber bypass via 103 Early Hints when combined with -i; reproduction inconclusive due to time budget, but prior CVE-2020-8177 and code structure make it credible.", "repro_outcome": "inconclusive", "usd": 0.46804, "seconds": 228.2, "priority": null}, {"id": "4024222", "label": "real", "title": "curl_mime_free stack overflow by recursion", "created_at": "2026-09-12T14:01:13.055Z", "verdict": "PLAUSIBLE", "confidence": 0.92, "headline": "The MIME cleanup path lacks recursion depth guards, allowing stack overflow on deeply nested structures; code analysis confirms the unbounded mutual recursion, though this was fixed in curl 8.17.0 (CVE-2025-0665).", "repro_outcome": "inconclusive", "usd": 0.58161, "seconds": 191.7, "priority": null}, {"id": "3468410", "label": "slop", "title": "Heap buffer overflow in Curl_ipv4_resolve_r due to incorrect buffer alignment and size calculation on AmigaOS", "created_at": "2025-12-17T05:44:02.316Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.7, "headline": "Report identifies a plausible alignment/padding issue in AmigaOS's Curl_ipv4_resolve_r, though the supplied code snippets do not match the actual source.", "repro_outcome": "inconclusive", "usd": 0.71326, "seconds": 542.4, "provider": "openrouter"}, {"id": "3506159", "label": "slop", "title": "Heap Out-of-Bounds Read in lib/http2.c via Malformed PUSH_PROMISE Headers", "created_at": "2026-01-10T19:22:25.801Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.85, "headline": "The on_header callback in lib/http2.c:1642 uses %s format specifier on non-null-terminated nghttp2 header buffers for PUSH_PROMISE frames, causing heap out-of-bounds read via strlen; static analysis confirms the bug exists in the 2026-01-10 codebase despite a similar CVE-2023-38545 fix.", "repro_outcome": "inconclusive", "usd": 0.73491, "seconds": 470.9, "provider": "openrouter"}, {"id": "3470095", "label": "slop", "title": "Heap Buffer Over-Read via Malicious SMB Server READ_ANDX Response", "created_at": "2025-12-18T11:38:42.997Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.85, "headline": "The claimed heap buffer over-read of uninitialized memory cannot occur because the receive buffer is fully initialized by the network read before the SMB_DOWNLOAD handler executes.", "repro_outcome": "inconclusive", "usd": 1.13088, "seconds": 1202.3, "provider": "openrouter"}, {"id": "3514263", "label": "slop", "title": "libcurl: Improper Authentication State Management on Cross-Protocol Redirects", "created_at": "2026-01-17T07:52:01.656Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.75, "headline": "CVE-2025-14524 is confirmed by multiple vendors; code architecture supports Bearer token leak on cross-protocol redirect, but redirect-handling code not in provided snippets and sandbox reproduction timed out.", "repro_outcome": "inconclusive", "usd": 0.76316, "seconds": 418.9, "provider": "openrouter"}, {"id": "3465094", "label": "slop", "title": "Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path Normalization", "created_at": "2025-12-15T07:45:05.932Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.98, "headline": "[Not yet reproduced] Path traversal bypass in file:// URLs via URL-encoded slashes (%2f) that evade dedotdotify() normalization and are decoded before filesystem access.", "repro_outcome": "not_reproduced", "usd": 0.7473, "seconds": 344.7, "provider": "openrouter"}, {"id": "3473182", "label": "slop", "title": "A logic error in detect_proxy caused truncation of environment variable names for long protocol schemes.", "created_at": "2025-12-20T06:19:17.734Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.95, "headline": "[Not yet reproduced] The detect_proxy function uses a 20-byte buffer for proxy environment variable names, but the URL parser allows schemes up to 40 characters, causing silent truncation and lookup of wrong environment variables for long scheme names.", "repro_outcome": "inconclusive", "usd": 0.63783, "seconds": 371.5, "provider": "openrouter"}, {"id": "3231321", "label": "slop", "title": "HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb Tunneling", "created_at": "2025-07-01T12:47:43.690Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.7, "headline": "Report describes a plausible logic flaw where CURLOPT_CUSTOMREQUEST=CONNECT on an http:// URL could trick a restrictive proxy into opening a tunnel; the relevant HTTP request construction code was not examined and reproduction did not complete.", "repro_outcome": "inconclusive", "usd": 0.73951, "seconds": 283.0, "provider": "openrouter"}, {"id": "3249936", "label": "slop", "title": "HTTP Request Smuggling Vulnerability Analysis - cURL Security Report", "created_at": "2025-07-13T13:42:11.154Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "cURL transmits user-provided headers verbatim; sending both Transfer-Encoding and Content-Length requires explicit user action and confers no extra capability to an attacker who already controls the command line.", "repro_outcome": "not_reproduced", "usd": 0.34396, "seconds": 370.1, "provider": "openrouter"}, {"id": "3272982", "label": "slop", "title": "Vulnerability Report: Public Exposure of Security Audit File", "created_at": "2025-07-26T21:18:06.517Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The report describes a website hosting issue (a PDF on curl.se), not a vulnerability in the libcurl codebase.", "repro_outcome": "not_reproduced", "usd": 0.1159, "seconds": 207.1, "provider": "openrouter"}, {"id": "3250490", "label": "slop", "title": "Disk Space Exhaustion leading to a Denial of Service (DoS)", "created_at": "2025-07-14T02:20:06.105Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.9, "headline": "The trace logging behavior is documented and expected for debugging options; disk consumption is a direct consequence of user-requested operation, not a security vulnerability.", "repro_outcome": "not_reproduced", "usd": 0.48627, "seconds": 432.7, "provider": "openrouter"}, {"id": "3395227", "label": "slop", "title": "Use of Deprecated strcpy() with User-Controlled Environment Variable in Memory Debug Initialization", "created_at": "2025-10-22T21:30:38.225Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The reported buffer overflow is prevented by existing truncation logic; strcpy() usage remains a code-quality concern but not a security vulnerability.", "repro_outcome": "inconclusive", "usd": 0.80658, "seconds": 358.9, "provider": "openrouter"}, {"id": "3403880", "label": "slop", "title": "Logical Flaw in curl_url_set Leads to Inconsistent Query Parameter Encoding", "created_at": "2025-10-29T10:51:20.103Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "[Not yet reproduced] curl_url_set() inconsistently encodes '=' in query strings: replace+URLENCODE encodes all '=' while append+URLENCODE keeps the first '=' literal, violating API contract.", "repro_outcome": "not_reproduced", "usd": 0.26154, "seconds": 265.2, "provider": "openrouter"}, {"id": "3452725", "label": "slop", "title": "Title: Use-After-Free in cURL Test Suite via Improper Cleanup of Global Handle", "created_at": "2025-12-05T08:09:14.389Z", "verdict": "NOT_REPRODUCED", "priority": null, "confidence": 0.95, "headline": "The reported use-after-free in test_lib1555 is not exploitable because each test runs in a separate process and the stale pointer is never accessed after cleanup.", "repro_outcome": "inconclusive", "usd": 0.7765, "seconds": 203.9, "provider": "openrouter"}, {"id": "3459636", "label": "slop", "title": "Stack Buffer Overflow in cURL wolfSSL Backend (lib/vtls/wolfssl.c)", "created_at": "2025-12-09T18:59:59.101Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.9, "headline": "Stack buffer overflow in wssl_strerror due to strcpy ignoring size parameter; DEBUGASSERT check disappears in release builds.", "repro_outcome": "inconclusive", "usd": 0.60989, "seconds": 238.1, "provider": "openrouter"}, {"id": "3735193", "label": "real", "title": "SASL double-free", "created_at": "2026-05-14T11:47:26.146Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.95, "headline": "[Not yet reproduced] Double-free in GSASL auth path: Curl_auth_gsasl_is_supported() frees gsasl->ctx on failure without nulling it, and Curl_auth_gsasl_cleanup() frees the same pointer again at connection teardown.", "repro_outcome": "inconclusive", "usd": 0.77565, "seconds": 315.5, "provider": "openrouter"}, {"id": "4030333", "label": "real", "title": "HTTP/2 upload Use-After-Free", "created_at": "2026-09-15T01:21:40.543Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Code analysis confirms a use-after-free in HTTP/2 upload retry path when RST_STREAM triggers HTTP/1.1 fallback; live reproduction blocked by missing test dependencies.", "repro_outcome": "inconclusive", "usd": 0.84206, "seconds": 317.8, "provider": "openrouter"}, {"id": "3459417", "label": "real", "title": "bearer token leak on cross-protocol redirect", "created_at": "2025-12-09T18:01:03.640Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.88, "headline": "Code analysis confirms libcurl clears user/password but not the OAuth2 bearer token during cross-protocol redirects, and the SASL layer will send that token to the new host; sandbox run did not complete but the logic and PoC logs are consistent.", "repro_outcome": "inconclusive", "usd": 0.84331, "seconds": 306.9, "provider": "nebius"}, {"id": "3583983", "label": "real", "title": "token leak with redirect and netrc", "created_at": "2026-03-03T22:21:02.246Z", "verdict": "PLAUSIBLE", "priority": null, "confidence": 0.98, "headline": "[Not yet reproduced] Sandbox reproduced the bearer token leak: --oauth2-bearer with --netrc sends the token to redirect targets due to netrc bypass at http.c:822 skipping the host check, while the HTTP bearer path lacks its own guard.", "repro_outcome": "inconclusive", "usd": 0.41191, "seconds": 475.7, "provider": "nebius"}, {"id": "4041053", "label": "real", "title": "password leak in CURLINFO_EFFECTIVE_URL", "created_at": "2026-09-18T19:55:50.637Z", "verdict": "CONFIRMED", "priority": null, "confidence": 0.95, "headline": "The sandbox reproduced the bug: .netrc credentials injected into the persistent URL handle survive a same-host relative redirect and leak verbatim into CURLINFO_EFFECTIVE_URL, verbose output, and %{url_effective}.", "repro_outcome": "reproduced", "usd": 0.57406, "seconds": 553.9, "provider": "nebius"}]}, "baseline": {"score": {"reports": 197, "slop_auto_closed": "31/49", "slop_auto_closed_pct": 63.3, "real_wrongly_closed": "0/148", "real_kept_pct": 100.0, "slop_closed_or_low": "31/49", "real_closed_or_low": "0/148", "verdicts": {"slop": {"FABRICATED": 31, "PLAUSIBLE": 18}, "real": {"PLAUSIBLE": 148}}, "avg_usd": 0.0014, "avg_seconds": 1.2, "wrongly_closed_ids": [], "missed_slop_ids": ["2912277", "3125820", "3230082", "3231321", "3395227", "3346118", "3399774", "3403880", "3400831", "3459636", "3418528", "3468410", "3465094", "3470095", "3506159", "3514263", "3473182", "3516186"]}, "rows": [{"id": "2887487", "label": "slop", "title": "Buffer Overflow Risk in Curl_inet_ntop and inet_ntop4", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report invents a non-existent `inet_ntop4` function and misrepresents `Curl_inet_ntop`; the real code uses `curlx_inet_ntop` which already validates buffer size and uses safe string functions.", "usd": 0.00209, "seconds": 1.43}, {"id": "2823554", "label": "slop", "title": "Buffer overflow in strcpy", "verdict": "FABRICATED", "confidence": 0.99, "headline": "The report describes a generic buffer overflow in OpenSSL's libcrypto.so with invented function names like __strcpy_evex and CRYPTO_strdup, contains no curl-specific code paths, and reads like a textbook exploit tutorial rather than a genuine vulnerability in curl.", "usd": 0.00233, "seconds": 1.44}, {"id": "2199174", "label": "slop", "title": "[Critical] Curl CVE-2023-38545 vulnerability code changes are disclosed on the internet", "verdict": "FABRICATED", "confidence": 0.99, "headline": "The report describes a non-existent CVE (CVE-2023-38545), invents a function `curl_easy_setopt` that does not exist in curl, cites a fake commit hash and version 8.4.0, and claims an LLM disclosed secret fix details, all hallmarks of AI-generated fabrication.", "usd": 0.00127, "seconds": 1.49}, {"id": "2298307", "label": "slop", "title": "Buffer Overflow Vulnerability in WebSocket Handling", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report references a non-existent file (lib/ws.c) and function (strcpy at line 581) in the curl codebase, indicating fabricated vulnerability details.", "usd": 0.00066, "seconds": 1.51}, {"id": "2819666", "label": "slop", "title": "Exploitable Format String Vulnerability in curl_mfprintf Function", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report demonstrates a standard format string bug in caller code, not a vulnerability in curl_mfprintf itself, and the compile commands reference non-existent paths.", "usd": 0.00057, "seconds": 1.54}, {"id": "2871792", "label": "slop", "title": "Buffer Overflow Vulnerability in strcpy() Leading to Remote Code Execution", "verdict": "FABRICATED", "confidence": 0.99, "headline": "The report contains a fabricated stack trace with impossible function names like __strcpy_evex and CRYPTO_strdup, references non-existent curl functions and memory addresses, and describes a generic textbook buffer overflow exploit that does not correspond to any actual curl codebase.", "usd": 0.00161, "seconds": 1.67}, {"id": "2912277", "label": "slop", "title": "Hackers Attack Curl Vulnerability Accessing Sensitive Information", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report describes a plausible .netrc credential leakage during HTTP redirects, which is a known class of curl vulnerability, though the description is vague and lacks a concrete proof-of-concept.", "usd": 0.00049, "seconds": 0.93}, {"id": "2981245", "label": "slop", "title": "(\"possible\") UAF", "verdict": "FABRICATED", "confidence": 0.99, "headline": "The report demonstrates a use-after-free in a completely fabricated example program with a made-up struct and function that do not exist in curl's codebase.", "usd": 0.00098, "seconds": 1.12}, {"id": "2905552", "label": "slop", "title": "bypass of this Fixed #2437131 [ Inadequate Protocol Restriction Enforcement in curl ]", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report describes expected behavior where later --proto flags override earlier ones, not a security bypass, and the examples show separate independent command invocations rather than a single command enforcing restrictions.", "usd": 0.00081, "seconds": 1.65}, {"id": "3101127", "label": "slop", "title": "Buffer Overflow in curl MQTT Test Server (tests/server/mqttd.c) via Malicious CONNECT Packet", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report targets mqttd.c, a test helper tool not included in curl releases, and the provided packet hex dump does not match the MQTT CONNECT packet structure described in the code, indicating the PoC is fabricated.", "usd": 0.0019, "seconds": 1.56}, {"id": "3116935", "label": "slop", "title": "Use of a Broken or Risky Cryptographic Algorithm (CWE-327) in libcurl", "verdict": "FABRICATED", "confidence": 0.95, "headline": "NTLMv1 protocol mandates DES usage for compatibility; replacing it with AES would break the protocol rather than fix a vulnerability in libcurl's implementation.", "usd": 0.00076, "seconds": 1.46}, {"id": "3117697", "label": "slop", "title": "Double Free Vulnerability in `libcurl` Cookie Management (`cookie.c`)", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report describes generic double-free patterns without demonstrating knowledge of curl's actual cookie.c logic, such as how Curl_node_remove interacts with list ownership or the specific error paths in Curl_cookie_add, making it indistinguishable from AI-generated slop.", "usd": 0.00086, "seconds": 0.99}, {"id": "3100073", "label": "slop", "title": "Path Traversal Vulnerability in curl via Unsanitized IPFS_PATH Environment Variable", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report describes a path traversal via IPFS_PATH that leaks file contents through DNS resolution errors, but curl's IPFS gateway handling treats the path as a local filesystem gateway directory, not a hostname, making the claimed 'Could not resolve host' error with file contents impossible and the exploit script's grep for that error message fabricated.", "usd": 0.00171, "seconds": 1.85}, {"id": "3125820", "label": "slop", "title": "HTTP/2 CONTINUATION Flood Vulnerability", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a plausible HTTP/2 CONTINUATION frame handling issue in libcurl with specific code references and a proof-of-concept, resembling known vulnerability class CVE-2023-44487, warranting maintainer investigation despite some AI-generated stylistic flourishes.", "usd": 0.00189, "seconds": 1.07}, {"id": "3125832", "label": "slop", "title": "HTTP/3 Stream Dependency Cycle Exploit", "verdict": "FABRICATED", "confidence": 0.99, "headline": "The report invents a non-existent HTTP/3 protocol, a fake ngtcp2 library, and a patched aioquic server to claim a cyclic stream dependency crash in curl, none of which exist in the real codebase.", "usd": 0.00177, "seconds": 1.17}, {"id": "3137657", "label": "slop", "title": "Memory Leak", "verdict": "FABRICATED", "confidence": 0.95, "headline": "This reports a memory leak of 2 bytes at program exit in a command-line tool, which is not a security vulnerability and is considered acceptable behavior for short-lived processes.", "usd": 0.00143, "seconds": 1.37}, {"id": "3158093", "label": "slop", "title": "Memory Leak in libcurl via Location Header Handling (CWE-770)", "verdict": "FABRICATED", "confidence": 0.98, "headline": "The report contains multiple fabrications including a non-existent curl version 8.14.0-DEV, fake package names like libnghttp3-dev and libpsl-dev, an invalid HTTP 302 status code, a non-existent --location flag, and references to source files that do not handle Location headers in the described manner.", "usd": 0.00183, "seconds": 1.35}, {"id": "3230082", "label": "slop", "title": "Stack-based Buffer Overflow in TELNET NEW_ENV Option Handling", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a specific, plausible logic error in `lib/telnet.c` where a length check fails to account for protocol control bytes added during formatting, includes a coherent exploit strategy, and provides a runnable PoC demonstrating the trigger.", "usd": 0.00215, "seconds": 1.25}, {"id": "3231321", "label": "slop", "title": "HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb Tunneling", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report describes a plausible logic flaw in CURLOPT_CUSTOMREQUEST handling with proxies that could allow CONNECT verb tunneling bypass, though the claimed libcurl version 8.14.1 does not exist and the PoC uses non-standard command flags.", "usd": 0.00196, "seconds": 1.25}, {"id": "3242005", "label": "slop", "title": "Use-After-Free in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurl", "verdict": "FABRICATED", "confidence": 0.99, "headline": "The report demonstrates a use-after-free in a standalone OpenSSL test program that manually invokes a callback after explicitly freeing the SSL object, which is not a libcurl code path or responsibility.", "usd": 0.00105, "seconds": 1.15}, {"id": "3249936", "label": "slop", "title": "HTTP Request Smuggling Vulnerability Analysis - cURL Security Report", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report invents a non-existent 'Transfer-Encoding' header and 'http_req_set_reader()' function, misstates the cURL version as 8.4.0, and describes a client-side request smuggling scenario that is not a vulnerability in cURL itself.", "usd": 0.00178, "seconds": 1.2}, {"id": "3272982", "label": "slop", "title": "Vulnerability Report: Public Exposure of Security Audit File", "verdict": "FABRICATED", "confidence": 0.95, "headline": "This report describes intentional public disclosure of a historical security audit, not a software vulnerability in curl itself.", "usd": 0.00076, "seconds": 1.02}, {"id": "3293884", "label": "slop", "title": "Vulnerability Report: Local File Disclosure via file:// Protocol in cURL", "verdict": "FABRICATED", "confidence": 0.99, "headline": "The file:// protocol is a documented, intended feature of curl for reading local files, not a vulnerability; accessing /etc/shadow requires root privileges which is expected OS behavior, not a curl flaw.", "usd": 0.00074, "seconds": 0.96}, {"id": "3295650", "label": "slop", "title": "Exposure of Hard-coded Private Keys and Credentials in curl Source Repository (CWE-321)", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report describes intentional test fixtures and documentation examples (e.g., test private keys, example credentials) as critical vulnerabilities, which is a classic false positive from automated secret scanners misclassifying harmless test data.", "usd": 0.00113, "seconds": 1.21}, {"id": "3250490", "label": "slop", "title": "Disk Space Exhaustion leading to a Denial of Service (DoS)", "verdict": "FABRICATED", "confidence": 0.95, "headline": "This is a feature, not a vulnerability: --trace/--trace-ascii explicitly requests verbose logging of all transferred data, and disk exhaustion is an expected consequence of user-enabled debug options, not a security flaw.", "usd": 0.00196, "seconds": 1.39}, {"id": "3335085", "label": "slop", "title": "TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation Bypass", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The PoC uses non-existent OpenSSL subcommands (genrsa, req -x509) and imaginary Python modules (http.server, ssl.SSLContext), proving the exploit code is AI-hallucinated and cannot execute.", "usd": 0.00206, "seconds": 1.07}, {"id": "3395227", "label": "slop", "title": "Use of Deprecated strcpy() with User-Controlled Environment Variable in Memory Debug Initialization", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a real strcpy usage with a user-controlled environment variable and a flawed truncation logic that modifies the input buffer, which is a legitimate code quality and security concern worth investigating.", "usd": 0.002, "seconds": 1.01}, {"id": "3340109", "label": "slop", "title": "Stack Buffer Overflow in cURL Cookie Parsing Leads to RCE", "verdict": "FABRICATED", "confidence": 0.99, "headline": "The report is entirely fabricated: it cites a non-existent function 'cookie_overflow_hunter' in a file 'cookie_vulnerability_hunter.c' that does not exist in curl, and the PoC merely demonstrates a self-inflicted strlen on a non-terminated local buffer, not a real curl vulnerability.", "usd": 0.00206, "seconds": 1.42}, {"id": "3392174", "label": "slop", "title": "Buffer Overflow in WebSocket Handshake (lib/ws.c:1287)", "verdict": "FABRICATED", "confidence": 0.99, "headline": "The report claims a buffer overflow in lib/ws.c at line 1287, but curl's source tree has no lib/ws.c file and the WebSocket implementation lives in lib/vwebsocket.c with a different handshake flow; the cited code snippet, version string (8.7.1), and exploit do not match the real codebase.", "usd": 0.00194, "seconds": 1.39}, {"id": "3346118", "label": "slop", "title": "Timing Attack Vulnerability in curl Digest Authentication via Non-Constant-Time String Comparison", "verdict": "PLAUSIBLE", "confidence": 0.75, "headline": "The report identifies a plausible timing side-channel in digest.c algorithm selection using strcmp, includes a specific code location and a suggested constant-time fix, and provides a PoC with measured nanosecond differences, so it warrants maintainer investigation despite the low practical impact.", "usd": 0.00105, "seconds": 1.48}, {"id": "3395218", "label": "slop", "title": "Use of Deprecated strcpy() with Fixed-Size Buffers in Progress Time Formatting", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report claims a buffer overflow but the source string \"--:--:--\" is 8 chars plus NUL = 9 bytes, while the destination buffers are declared as 10 bytes, so strcpy fits safely; the alleged off-by-one and exploitation scenarios are fabricated.", "usd": 0.00189, "seconds": 1.28}, {"id": "3399774", "label": "slop", "title": "Integer Overflow to Heap Overflow in DoH Response Handling", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a plausible integer overflow in `doh_probe_write_cb` where `size * nmemb` wraps, causing a heap overflow via `curlx_dyn_addn`; the PoC uses internal types but demonstrates a real logic flaw that warrants maintainer investigation.", "usd": 0.00173, "seconds": 1.27}, {"id": "3418646", "label": "slop", "title": "Arbitrary Configuration File Inclusion: via External Control of File Name or Path", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report describes intended behavior of the --config feature (reading user-specified config files) as a vulnerability, which is not a security flaw in curl.", "usd": 0.0014, "seconds": 1.13}, {"id": "3403880", "label": "slop", "title": "Logical Flaw in curl_url_set Leads to Inconsistent Query Parameter Encoding", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report identifies a specific, plausible logic inconsistency in curl_url_set() regarding equalsencode flag handling between replace and append operations, supported by a compilable PoC demonstrating the behavioral difference.", "usd": 0.00189, "seconds": 1.25}, {"id": "3400831", "label": "slop", "title": "CURLX_SET_BINMODE(NULL) can call fileno(NULL) and cause undefined behavior / crash", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a real code pattern in tool_binmode.h where CURLX_SET_BINMODE(NULL) expands to an unguarded fileno(NULL) call, which is a legitimate robustness/UB issue in curl's own source, not invented code.", "usd": 0.00113, "seconds": 1.28}, {"id": "3452725", "label": "slop", "title": "Title: Use-After-Free in cURL Test Suite via Improper Cleanup of Global Handle", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report describes a bug in a test file (lib1555.c) that is not part of the production curl library, and the alleged use-after-free cannot occur because the test function is called only once per process and the process exits immediately after.", "usd": 0.00209, "seconds": 1.05}, {"id": "3459636", "label": "slop", "title": "Stack Buffer Overflow in cURL wolfSSL Backend (lib/vtls/wolfssl.c)", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a plausible strcpy overflow in wssl_strerror when DEBUGASSERT is disabled, but the PoC simulates the function rather than exercising real curl/wolfSSL code paths, so a maintainer must verify the actual buffer-size contract and call sites.", "usd": 0.00092, "seconds": 1.01}, {"id": "3418528", "label": "slop", "title": "Unsafe use of strcpy in Curl_ldap_err2string (packages/OS400/os400sys.c) \u2014 stack-buffer-overflow (PoC + ASan)", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "Report targets a real platform-specific file (packages/OS400/os400sys.c) and function (Curl_ldap_err2string) with a plausible strcpy overflow via attacker-controlled LDAP error strings, includes ASAN build steps and a reproducible PoC concept, making it a credible, non-generic finding despite the verbose template style.", "usd": 0.00189, "seconds": 1.3}, {"id": "3462525", "label": "slop", "title": "Buffer Overflow in cURL Internal printf Function", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report describes a non-existent function curl_msprintf in lib/mprintf.c; the actual code uses curl_mprintf with a size parameter and bounds-checked callbacks, making the described overflow impossible.", "usd": 0.00109, "seconds": 1.12}, {"id": "3468410", "label": "slop", "title": "Heap buffer overflow in Curl_ipv4_resolve_r due to incorrect buffer alignment and size calculation on AmigaOS", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report targets a real, platform-specific file (lib/amigaos.c) and function (Curl_ipv4_resolve_r) with a plausible alignment/padding bug in a heap buffer passed to gethostbyname_r, which is a known class of vulnerability.", "usd": 0.00057, "seconds": 1.06}, {"id": "3465094", "label": "slop", "title": "Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path Normalization", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a specific, plausible logic gap in curl's file:// URL handling where URL-encoded slashes bypass the dotdot normalization before decoding, and cites actual source locations and a unit test that appears to confirm the current behavior.", "usd": 0.00221, "seconds": 1.15}, {"id": "3470095", "label": "slop", "title": "Heap Buffer Over-Read via Malicious SMB Server READ_ANDX Response", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report provides a detailed technical analysis with specific code locations, root cause explanation, and a working proof-of-concept demonstrating a heap buffer over-read in libcurl's SMB implementation.", "usd": 0.00209, "seconds": 1.02}, {"id": "3466883", "label": "slop", "title": "Curl Alt-Svc Parser Stack Buffer Overflow", "verdict": "FABRICATED", "confidence": 0.99, "headline": "The report invents a non-existent 'Alt-Svc' header parser, fake CVE details, impossible version ranges (7.64.0-7.89.0), and includes a full ROP exploit payload, all of which are fabrications that do not exist in the curl codebase.", "usd": 0.00233, "seconds": 1.23}, {"id": "3466896", "label": "slop", "title": "Heap Overflow in cURL AmigaOS Socket Implementation", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report invents a non-existent function `Curl_ipv4_resolve_r` and file `amigaos.c`; curl's AmigaOS code lives in `lib/amiga.c` and uses `Curl_getaddrinfo_ex` with `getaddrinfo`, not the described `gethostbyname_r` API, making the entire technical analysis fabricated.", "usd": 0.00195, "seconds": 1.27}, {"id": "3516202", "label": "slop", "title": "Cookie Replacement Use-After-Free Vulnerability", "verdict": "FABRICATED", "confidence": 0.95, "headline": "The report invents a non-existent function `replace_existing` and line numbers that do not match the real `lib/cookie.c`, misnames AddressSanitizer (ASan), and provides a fabricated PoC server and patch, all hallmarks of AI-generated slop.", "usd": 0.00178, "seconds": 1.14}, {"id": "1040166", "label": "real", "title": "trusting FTP PASV responses", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a known FTP PASV IP trust issue (CURLOPT_FTP_SKIP_PASV_IP default behavior) that enables SSRF-based port scanning, which is a legitimate, documented curl security concern.", "usd": 0.00094, "seconds": 1.09}, {"id": "3506159", "label": "slop", "title": "Heap Out-of-Bounds Read in lib/http2.c via Malformed PUSH_PROMISE Headers", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible API contract violation in lib/http2.c where nghttp2 provides non-null-terminated buffers with lengths, but the code passes raw pointers to curl_maprintf with %s, causing a heap out-of-bounds read via strlen; the provided patch using %.*s with explicit lengths is the correct mitigation.", "usd": 0.00169, "seconds": 1.31}, {"id": "3514263", "label": "slop", "title": "libcurl: Improper Authentication State Management on Cross-Protocol Redirects", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a plausible logic gap in libcurl's redirect credential clearing (CVE-2022-27774 fix) where OAuth2 bearer tokens stored separately from user/password fields might not be cleared on cross-protocol redirects, and it provides a specific code location and a reproducible proof-of-concept.", "usd": 0.00193, "seconds": 1.27}, {"id": "3473182", "label": "slop", "title": "A logic error in detect_proxy caused truncation of environment variable names for long protocol schemes.", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a genuine buffer size mismatch between the fixed 20-byte proxy_env buffer and the 40-character MAX_SCHEME_LEN, causing silent truncation of environment variable names for long protocol schemes.", "usd": 0.00079, "seconds": 1.71}, {"id": "3516186", "label": "slop", "title": "Cookie Max-Age Integer Overflow Vulnerability", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report identifies a plausible edge-case integer overflow in the cookie Max-Age expiration calculation in lib/cookie.c and provides a concrete code location, exploitation scenarios, and a runnable PoC, making it specific and actionable enough for maintainer review despite some generic padding.", "usd": 0.00185, "seconds": 2.26}, {"id": "1101882", "label": "real", "title": "Automatic referer leaks credentials", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "This is a legitimate, well-documented report about a real referer header leakage issue with a valid patch, not AI-generated slop.", "usd": 0.00129, "seconds": 1.08}, {"id": "1045844", "label": "real", "title": "FTP wildcard stack overflow", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report includes a detailed stack trace showing recursive calls to wc_statemach in ftp.c leading to a stack overflow, a reproducible test case, and analysis linking it to FTP wildcard handling on Windows, indicating a genuine vulnerability.", "usd": 0.00199, "seconds": 1.19}, {"id": "1172857", "label": "real", "title": "schannel cipher selection surprise", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a specific, plausible concurrency bug in a recent commit where a static array causes cipher configuration bleed across handles, which is a real code logic error, not AI hallucination.", "usd": 0.00067, "seconds": 0.77}, {"id": "1048457", "label": "real", "title": "Inferior OCSP verification", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a specific, plausible logic flaw in OpenSSL OCSP staple verification (missing serial number check) with a reproducible proof-of-concept and suggested patch, which is actionable and not generic AI slop.", "usd": 0.00079, "seconds": 1.2}, {"id": "1129529", "label": "real", "title": "TLS 1.3 session ticket proxy host mixup", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific logic error in Curl_ssl_addsessionid regarding CONNECT_PROXY_SSL() state tracking for TLS 1.3 post-handshake tickets, provides a detailed technical explanation, and includes a working reproducer demonstrating both the ticket misdirection and a limited MitM scenario.", "usd": 0.00168, "seconds": 1.24}, {"id": "1213181", "label": "real", "title": "Metalink download sends credentials", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a plausible credential leakage issue specific to curl's metalink feature where credentials are reused across hosts/protocols without user consent, which is a known class of vulnerability in curl's redirect handling.", "usd": 0.00062, "seconds": 0.82}, {"id": "1176461", "label": "real", "title": "TELNET stack contents disclosure", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a specific, plausible logic error in lib/telnet.c where sscanf's return value is checked incorrectly, potentially leaking stack contents via uninitialized buffer gaps, and provides a detailed reproduction case.", "usd": 0.00341, "seconds": 1.03}, {"id": "1223565", "label": "real", "title": "Bad connection reuse due to flawed path name checks", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies specific, plausible logic flaws in Curl_ssl_config_matches regarding missing BLOB option checks, missing ISSUERCERT comparison, and incorrect case-insensitive path/fingerprint comparisons, complete with a reproducible test case and proposed fix.", "usd": 0.00154, "seconds": 0.87}, {"id": "1180380", "label": "real", "title": "TLS session caching disaster", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report identifies a plausible use-after-free scenario in OpenSSL session caching when connections are detached/attached without updating ex_data pointers, which is a specific, code-level concern rather than generic AI slop.", "usd": 0.00092, "seconds": 1.11}, {"id": "1213175", "label": "real", "title": "Wrong content via metalink not discarded", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "This report describes a plausible logic gap in curl's metalink hash verification where a failed checksum does not trigger file deletion, which is a valid security concern for a maintainer to evaluate.", "usd": 0.00061, "seconds": 1.08}, {"id": "1223882", "label": "real", "title": "TELNET stack contents disclosure again", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report provides a detailed technical analysis of a specific logic error in the telnet.c fix for CVE-2021-22898, identifying an incorrect length calculation leading to stack memory disclosure and a regression in valid input handling.", "usd": 0.00124, "seconds": 1.07}, {"id": "1234760", "label": "real", "title": "CURLOPT_SSLCERT mixup with Secure Transport", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a plausible logic bug in the Secure Transport backend where a local file shadows a keychain certificate nickname, contrary to documented behavior and inconsistent with the NSS backend implementation.", "usd": 0.00067, "seconds": 0.76}, {"id": "1269242", "label": "real", "title": "UAF and double-free in MQTT sending", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible use-after-free and double-free in lib/mqtt.c with a detailed trigger scenario and a working reproducer patch.", "usd": 0.00148, "seconds": 0.79}, {"id": "1526328", "label": "real", "title": "OAUTH2 bearer bypass in connection re-use", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a specific, plausible connection reuse vulnerability in curl's SASL/OAUTH2 handling with a reproducible command sequence and a referenced patch, indicating a genuine security issue rather than AI-generated slop.", "usd": 0.00065, "seconds": 0.63}, {"id": "1334763", "label": "real", "title": "STARTTLS protocol injection via MITM", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report describes a plausible STARTTLS command injection vulnerability with a specific test case in the curl test suite, warranting maintainer investigation despite the brief description.", "usd": 0.00038, "seconds": 0.78}, {"id": "1334111", "label": "real", "title": "Protocol downgrade required TLS bypassed", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a specific, plausible logic flaw in curl's protocol handling for IMAP, POP3, and FTP where mandatory TLS requirements are silently ignored under specific server error conditions, which is a known class of vulnerability in curl.", "usd": 0.00053, "seconds": 1.05}, {"id": "1543773", "label": "real", "title": "Credential leak on redirect", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "This report describes a plausible credential leak when curl follows an HTTPS-to-FTP redirect without --location-trusted, which contradicts documented behavior and warrants investigation.", "usd": 0.00074, "seconds": 0.95}, {"id": "1546268", "label": "real", "title": "Bad local IPv6 connection reuse", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a specific, reproducible bug in curl's connection reuse logic where IPv6 zone indices are ignored, which is a valid security issue for maintainers to investigate.", "usd": 0.00072, "seconds": 1.12}, {"id": "1553301", "label": "real", "title": "cookie for trailing dot TLD", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report demonstrates a specific, reproducible cookie parsing bypass where a trailing dot on a TLD circumvents existing TLD blocking logic, which is a plausible and actionable vulnerability.", "usd": 0.00065, "seconds": 1.11}, {"id": "1553841", "label": "real", "title": "percent-encoded path separator in URL host", "verdict": "PLAUSIBLE", "confidence": 0.8, "headline": "The report describes a plausible SSRF filter bypass via percent-encoded path separators in proxy URLs, with specific reproduction steps and a clear recommended fix, warranting maintainer investigation.", "usd": 0.00109, "seconds": 0.95}, {"id": "1547048", "label": "real", "title": "Auth/cookie leak on redirect ", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a plausible logic gap in HTTP redirect handling where sensitive headers are not stripped when the protocol or port changes, referencing a specific code location and prior CVE.", "usd": 0.00073, "seconds": 1.39}, {"id": "1553598", "label": "real", "title": "curl removes wrong file on error", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a specific, plausible logic conflict between two documented curl features (--no-clobber and --remove-on-error) with references to relevant source code lines, suggesting a genuine bug rather than AI hallucination.", "usd": 0.00074, "seconds": 1.28}, {"id": "1555441", "label": "real", "title": "CERTINFO never-ending busy-loop", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a plausible infinite loop in NSS certificate chain traversal when CERTINFO is enabled, provides a specific code location, a reproducible PoC with a crafted certificate loop, and acknowledges the limited scope (NSS + CERTINFO), making it a valid security issue for maintainer investigation.", "usd": 0.00115, "seconds": 1.09}, {"id": "1555796", "label": "real", "title": "TLS and SSH connection too eager reuse", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies specific CURLOPT options missing from the connection reuse logic with reproducible steps, indicating a genuine security logic bug rather than AI hallucination.", "usd": 0.00076, "seconds": 1.33}, {"id": "1569946", "label": "real", "title": "Set-Cookie denial of service", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a plausible cookie jar DoS via unlimited domain cookies with a working reproducer and references a real CWE class, warranting maintainer investigation.", "usd": 0.00078, "seconds": 1.19}, {"id": "1573634", "label": "real", "title": "Unpreserved file permissions", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a real file permission preservation issue in curl's cookie/alt-svc/HSTS database handling with reproducible steps and references a specific commit, making it a legitimate security concern rather than AI-generated slop.", "usd": 0.0011, "seconds": 1.0}, {"id": "1557449", "label": "real", "title": "HSTS bypass via trailing dot", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a specific, plausible HSTS cache bypass using a trailing dot in the hostname, provides a reproducible test case with a sample cache file and command, and references prior art in other HTTP clients, indicating a genuine logic flaw in host matching rather than AI hallucination.", "usd": 0.00066, "seconds": 1.34}, {"id": "1570651", "label": "real", "title": "HTTP compression denial of service", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a plausible unbounded memory allocation issue in curl's header parsing logic with specific, reproducible steps and observed crashes on multiple platforms.", "usd": 0.00072, "seconds": 1.15}, {"id": "1590071", "label": "real", "title": "FTP-KRB bad message verification", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a specific logic error in curl's krb5_decode function where a -1 error return is assigned to a size_t buffer size, causing integer wraparound and potential heap memory disclosure or protocol injection, which is a plausible code-level vulnerability in a supported authentication mechanism.", "usd": 0.00129, "seconds": 1.15}, {"id": "1613943", "label": "real", "title": "control code in cookie denial of service", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a plausible cookie parsing issue where curl accepts control characters in cookie values that servers later reject, potentially causing a persistent denial of service.", "usd": 0.00175, "seconds": 1.12}, {"id": "1722065", "label": "real", "title": "HTTP proxy double-free", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Valgrind output shows a concrete double-free in Curl_free_request_state and conn_free with a reproducible command, indicating a real memory management bug in HTTP proxy handling.", "usd": 0.00185, "seconds": 1.09}, {"id": "1721098", "label": "real", "title": ".netrc parser out-of-bounds access", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible out-of-bounds read/write in parsenetrc() when processing a .netrc file lacking whitespace, supported by code snippets and a reproducible test case.", "usd": 0.0008, "seconds": 1.16}, {"id": "1704017", "label": "real", "title": "POST following PUT confusion", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a plausible logic bug where CURLOPT_UPLOAD state persists across requests, causing a POST to become a PUT and read from the wrong buffer, which is a real code behavior issue not an AI hallucination.", "usd": 0.00119, "seconds": 1.18}, {"id": "1755083", "label": "real", "title": "Another HSTS bypass via IDN", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a plausible HSTS cache bypass via IDN homoglyph conversion with a specific code location and reproducible steps, warranting maintainer investigation.", "usd": 0.00087, "seconds": 0.96}, {"id": "1730660", "label": "real", "title": "HSTS bypass via IDN", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a plausible HSTS bypass via IDN homograph conversion of a fullwidth dot to ASCII dot, includes reproducible curl commands and cache file, and notes certificate validation works, indicating a real logic gap in host matching.", "usd": 0.00188, "seconds": 1.13}, {"id": "1826048", "label": "real", "title": "HTTP multi-header compression denial of service", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a specific, plausible DoS vector in curl's HTTP header parsing with a concrete test case and patch, indicating genuine vulnerability research rather than AI hallucination.", "usd": 0.00042, "seconds": 0.54}, {"id": "1764858", "label": "real", "title": "HTTP Proxy deny use-after-free", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report provides specific, reproducible command lines that trigger a use-after-free in the HTTP proxy CONNECT handling for telnet and SMB protocols, which is a concrete, actionable security issue.", "usd": 0.00047, "seconds": 0.86}, {"id": "1813864", "label": "real", "title": "curl HSTS ignored on multiple requests", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a specific, plausible logic bug in curl's HSTS cache handling across multiple URLs in a single command line, which is a known area of complexity and not an invented or generic vulnerability.", "usd": 0.0004, "seconds": 0.85}, {"id": "1892351", "label": "real", "title": "SFTP path ~ resolving discrepancy", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a specific, plausible logic discrepancy in Curl_getworkingpath regarding tilde expansion for SFTP that could bypass path traversal checks, warranting maintainer investigation.", "usd": 0.00062, "seconds": 0.79}, {"id": "1891474", "label": "real", "title": "Telnet option IAC injection", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a plausible IAC (0xff) injection vulnerability in CURLOPT_TELNETOPTIONS handling with a concrete reproduction case and packet capture evidence.", "usd": 0.00098, "seconds": 0.93}, {"id": "1814333", "label": "real", "title": "HSTS amnesia with --parallel", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a plausible race condition in HSTS cache handling when using --parallel, which is a specific curl feature interaction that could cause real security issues.", "usd": 0.00039, "seconds": 0.99}, {"id": "1895135", "label": "real", "title": "GSS delegation too eager connection re-use", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a specific logic gap in connection reuse where CURLOPT_GSSAPI_DELEGATION is not considered, providing clear reproduction steps and a reasoned remediation approach.", "usd": 0.00057, "seconds": 0.99}, {"id": "1892780", "label": "real", "title": "FTP too eager connection reuse", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a specific, plausible logic bug in FTP connection reuse regarding CURLOPT_FTP_ACCOUNT with a detailed reproduction scenario and RFC reference, warranting maintainer investigation.", "usd": 0.00071, "seconds": 1.23}, {"id": "1897203", "label": "real", "title": "HSTS double-free", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a plausible thread-safety issue in HSTS entry removal where the shared lock may not be held during list removal and free, and provides a reproducer using curl's share interface with locking callbacks.", "usd": 0.00138, "seconds": 1.0}, {"id": "1950627", "label": "real", "title": "IDN wildcard match", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a specific logic error in hostcheck.c where the IDN wildcard check incorrectly examines the certificate pattern instead of the hostname, potentially allowing invalid wildcard matches for internationalized domain names.", "usd": 0.0008, "seconds": 1.11}, {"id": "2072338", "label": "real", "title": "HTTP header allocation DOS", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a plausible unbounded header parsing issue in curl's HTTP handling with a reproducible test case, which is a known class of vulnerability in HTTP clients.", "usd": 0.00082, "seconds": 1.1}, {"id": "1898475", "label": "real", "title": "SSH connection too eager reuse still", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a specific bitmask comparison bug in SSH connection reuse logic with a plausible fix, indicating genuine code analysis rather than generic AI slop.", "usd": 0.00046, "seconds": 2.09}, {"id": "1913733", "label": "real", "title": "UAF in SSH sha256 fingerprint check", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a clear use-after-free bug where fingerprint_b64 is passed to failf() after being freed, which is a valid vulnerability in the curl codebase.", "usd": 0.00101, "seconds": 1.98}, {"id": "1929597", "label": "real", "title": "siglongjmp race condition", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a plausible race condition in the USE_ALARM_TIMEOUT code path involving a global sigjmp_buf accessed from a signal handler without thread synchronization, which is a known class of bug in curl's DNS timeout handling.", "usd": 0.00222, "seconds": 2.06}, {"id": "1954658", "label": "real", "title": "more POST-after-PUT confusion", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a plausible logic gap where CURLOPT_POSTFIELDS and related options may not correctly reset the upload state after a PUT, which is a concrete code behavior issue rather than AI hallucination.", "usd": 0.00135, "seconds": 1.28}, {"id": "2148242", "label": "real", "title": "cookie injection with none file", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a specific code path in curl_easy_duphandle and Curl_cookie_init where a default filename 'none' could load cookies from a local file named 'none', which appears to be a plausible logic bug worth investigating.", "usd": 0.00072, "seconds": 1.19}, {"id": "2384833", "label": "real", "title": "Usage of disabled protocol", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, reproducible bug in curl's protocol handling logic introduced in a known commit, with clear steps to reproduce and a bisected root cause, making it a valid vulnerability report rather than AI-generated slop.", "usd": 0.00112, "seconds": 1.01}, {"id": "2212193", "label": "real", "title": "cookie mixed case PSL bypass", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a specific, plausible logic error in libcurl's PSL cookie domain handling where hostname normalization to lowercase is missing before the PSL check, allowing mixed-case domains to bypass supercookie protections, complete with reproducible steps and evidence.", "usd": 0.00081, "seconds": 1.15}, {"id": "2236133", "label": "real", "title": "HSTS long file name clears contents", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report demonstrates a plausible file-system edge case where an over-long HSTS filename causes the temporary-file rename to fail and the database to be truncated, which is a real bug in curl's file handling rather than AI-invented nonsense.", "usd": 0.00213, "seconds": 1.15}, {"id": "2187833", "label": "real", "title": "socks5 heap buffer overflow", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a plausible state machine bug where a local variable fix for long hostnames is not persisted across state transitions, potentially causing a heap buffer overflow in the SOCKS5 negotiation buffer.", "usd": 0.00204, "seconds": 1.47}, {"id": "2298922", "label": "real", "title": "OCSP verification bypass with TLS session reuse", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a specific, reproducible logic flaw in curl 8.5.0 where OCSP stapling verification is skipped during TLS session reuse, allowing a previously failed revoked certificate check to be bypassed on subsequent requests, complete with a test URL and command output demonstrating the behavior.", "usd": 0.00079, "seconds": 1.49}, {"id": "2402845", "label": "real", "title": "HTTP/2 push headers memory-leak", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible memory leak in curl's HTTP/2 PUSH_PROMISE handling with code references and valgrind evidence, indicating a genuine vulnerability rather than AI-generated slop.", "usd": 0.00209, "seconds": 1.32}, {"id": "2559516", "label": "real", "title": "freeing stack buffer in utf8asn1str", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a real bug: free() is called on a stack-allocated buffer 'buf[4]' in utf8asn1str(), which is undefined behavior and a valid security issue.", "usd": 0.00132, "seconds": 1.38}, {"id": "2410774", "label": "real", "title": "QUIC certificate check bypass with wolfSSL", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible logic error in curl's wolfSSL QUIC initialization where an error code is overwritten with success, potentially skipping certificate verification under specific build configurations and user inputs.", "usd": 0.00162, "seconds": 1.42}, {"id": "2416725", "label": "real", "title": "TLS certificate check bypass with mbedTLS", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a specific logic gap in curl's mbedTLS backend where certificate verification is skipped for IP addresses due to missing SNI/hostname setting, which is a plausible and verifiable code issue.", "usd": 0.00212, "seconds": 1.41}, {"id": "2604391", "label": "real", "title": "macidn punycode buffer overread", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a real buffer over-read in mac_idn_to_ascii() caused by ICU's uidna_nameToASCII_UTF8() not NUL-terminating output when it exactly fills the buffer, provides a valid PoC and stack trace, and includes a correct fix.", "usd": 0.0021, "seconds": 1.18}, {"id": "2629968", "label": "real", "title": "ASN.1 date parser overread", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible integer underflow in GTime2str leading to an out-of-bounds read via strlen, provides a minimal reproducer, sanitizer trace, and affected build configurations, making it a credible vulnerability rather than AI-generated slop.", "usd": 0.00283, "seconds": 1.06}, {"id": "2669852", "label": "real", "title": "OCSP stapling bypass with GnuTLS", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific logic flaw in curl's GnuTLS backend where gnutls_ocsp_status_request_is_checked() is misused to validate OCSP stapling, causing non-revoked error statuses (like 'unauthorized') to be incorrectly treated as success.", "usd": 0.00163, "seconds": 1.0}, {"id": "2829063", "label": "real", "title": "netrc + redirect credential leak", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a specific, plausible logic flaw in curl's .netrc credential handling during redirects with a concrete reproduction scenario and clear impact assessment.", "usd": 0.00053, "seconds": 1.02}, {"id": "2954286", "label": "real", "title": "eventfd double close", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report references a specific GitHub issue (15725) and describes a plausible race condition involving eventfd double-close leading to file descriptor reuse, which is a known class of vulnerability in multi-threaded programs using libcurl.", "usd": 0.00073, "seconds": 0.96}, {"id": "2956023", "label": "real", "title": "gzip integer overflow", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific integer overflow in gzip header parsing with a detailed proof-of-concept demonstrating controlled heap corruption via repeated gzip_do_write() calls.", "usd": 0.00145, "seconds": 1.11}, {"id": "2764830", "label": "real", "title": "HSTS subdomain overwrites parent cache entry", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report provides a detailed, reproducible test case demonstrating a specific logic error in HSTS cache handling where a subdomain's policy incorrectly overwrites the parent domain's expiration timestamp, which is a plausible and verifiable bug in curl's HSTS implementation.", "usd": 0.00122, "seconds": 1.23}, {"id": "2917232", "label": "real", "title": "netrc and default credential leak", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report describes a specific test case (test479) and .netrc behavior suggesting a potential regression or incomplete fix for CVE-2024-11053, warranting maintainer verification.", "usd": 0.0005, "seconds": 1.21}, {"id": "3153497", "label": "real", "title": "No QUIC certificate pinning with wolfSSL", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a specific missing implementation of certificate pinning for wolfSSL with HTTP/3, which is a plausible code gap rather than an invented vulnerability.", "usd": 0.00065, "seconds": 0.75}, {"id": "3168039", "label": "real", "title": "WebSocket endless loop", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report provides a specific code location, a detailed trigger condition involving WebSocket frame construction and PING/PONG handling, and a reproducible PoC with both client and server code demonstrating 100% CPU hang.", "usd": 0.00213, "seconds": 0.98}, {"id": "3150884", "label": "real", "title": "QUIC certificate check skip with wolfSSL", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a specific code path in curl's wolfSSL backend where hostname verification is skipped for IP addresses because peer->sni is NULL, which is a plausible and verifiable logic bug.", "usd": 0.0009, "seconds": 1.33}, {"id": "3355218", "label": "real", "title": "missing SFTP host verification with wolfSSH", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report provides specific code references, build instructions, and runtime observations demonstrating that the wolfSSH backend lacks host key verification, which is a genuine security vulnerability in a supported SSH backend.", "usd": 0.00219, "seconds": 1.15}, {"id": "3330839", "label": "real", "title": "predictable WebSocket mask", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a spec violation (RFC 6455 \u00a75.3) where curl reuses a single masking key for all WebSocket frames instead of generating a fresh unpredictable key per frame, which is a genuine security weakness.", "usd": 0.00109, "seconds": 1.23}, {"id": "3459417", "label": "real", "title": "bearer token leak on cross-protocol redirect", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a specific, plausible logic gap in curl's redirect handling where OAuth2 bearer tokens are not cleared alongside user credentials during cross-protocol redirects, includes a detailed code analysis pointing to the exact location, and provides a reproducible PoC with a custom server simulating the attack scenario.", "usd": 0.00205, "seconds": 0.85}, {"id": "3294999", "label": "real", "title": "Out of bounds read for cookie path", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report identifies a plausible out-of-bounds read in replace_existing when clist->spath is an empty string, provides a clear code path via sanitize_cookie_path, and includes a reproducible test case against current HEAD.", "usd": 0.00187, "seconds": 1.42}, {"id": "3477116", "label": "real", "title": "libssh global knownhost override ", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a plausible logic gap in curl's libssh backend where CURLOPT_SSH_KNOWNHOSTS does not disable the global knownhosts fallback, which could weaken host verification; it references specific libssh source lines and provides reproducible steps, so it warrants maintainer investigation rather than immediate closure.", "usd": 0.00087, "seconds": 1.06}, {"id": "3480925", "label": "real", "title": "libssh key passphrase bypass without agent set", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a specific logic flaw in libcurl's libssh backend where CURLSSH_AUTH_PUBLICKEY implicitly enables agent authentication, which is a plausible and verifiable code behavior issue.", "usd": 0.00086, "seconds": 1.14}, {"id": "3583983", "label": "real", "title": "token leak with redirect and netrc", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed, code-specific report with reproducible test cases showing a real token leak via the netrc bypass in the HTTP bearer path, consistent with a known CVE class and confirmed against current master.", "usd": 0.00216, "seconds": 1.09}, {"id": "3584903", "label": "real", "title": "wrong proxy connection reuse with credentials", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible logic gap in proxy_info_matches() where proxy credentials are not compared during connection reuse, provides a detailed reproduction scenario with a shared connection cache, and demonstrates a clear security impact for multi-tenant environments.", "usd": 0.00113, "seconds": 1.05}, {"id": "3591944", "label": "real", "title": "use after free in SMB connection reuse", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report provides a detailed, plausible, and reproducible use-after-free scenario in the SMB connection reuse logic with specific code paths and a working ASAN-triggering test case.", "usd": 0.00107, "seconds": 0.96}, {"id": "3621851", "label": "real", "title": "connection reuse ignores TLS requirement", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a specific, plausible logic flaw in curl's connection reuse logic for cleartext-upgrade protocols (SMTP/POP3/IMAP) where CURLOPT_USE_SSL is not considered during reuse checks, includes a detailed reproduction case with a test server and curl command sequences, and identifies the exact affected protocols and code behavior.", "usd": 0.00067, "seconds": 0.98}, {"id": "3642555", "label": "real", "title": "wrong reuse of HTTP Negotiate connection", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report provides a detailed, code-specific analysis of a logic flaw in curl's connection reuse mechanism involving NTLM and Negotiate authentication interaction, with a reproducible PoC and server logs demonstrating the vulnerability.", "usd": 0.00214, "seconds": 1.35}, {"id": "3650689", "label": "real", "title": "wrong reuse of SMB connection", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible logic error in curl's SMB connection reuse code (missing share name check in url_match_proto_config) and provides a detailed, reproducible proof-of-concept demonstrating data spoofing across shares.", "usd": 0.00203, "seconds": 1.19}, {"id": "3694390", "label": "real", "title": "OCSP stapling bypass with Apple SecTrust", "verdict": "PLAUSIBLE", "confidence": 0.98, "headline": "Detailed, reproducible report with code analysis showing a logic flaw where SecTrust verification bypasses OCSP stapling enforcement when no staple is present, affecting documented curl behavior.", "usd": 0.00221, "seconds": 0.96}, {"id": "3669637", "label": "real", "title": "proxy credentials leak over redirect-to proxy", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed, reproducible report of a specific proxy credential leak across redirect-induced proxy re-selection with clear steps, version info, and observed network traffic evidence.", "usd": 0.00136, "seconds": 1.18}, {"id": "3671818", "label": "real", "title": "stale custom cookie host causes cookie leak", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report provides specific code locations, a detailed reproduction scenario with a proof-of-concept, and demonstrates a clear cookie isolation bypass in libcurl's handling of custom Host headers.", "usd": 0.00112, "seconds": 1.19}, {"id": "3677759", "label": "real", "title": "netrc credential leak with reused proxy connection", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "Detailed, reproducible report with PoC, logs, and controls demonstrating a specific credential leak in libcurl's .netrc handling with proxy connection reuse, not generic AI slop.", "usd": 0.00129, "seconds": 1.12}, {"id": "3697719", "label": "real", "title": "cross-proxy Digest auth state leak", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed technical report with specific source code references, reproducible PoC, and clear demonstration of cross-proxy Digest auth state leakage on handle reuse.", "usd": 0.00149, "seconds": 0.68}, {"id": "3735184", "label": "real", "title": "password leak with netrc and user in URL", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a specific, reproducible logic bug in curl's .netrc credential selection where a URL-provided username is incorrectly paired with a different user's password from .netrc, complete with a working proof-of-concept and clear expected vs actual behavior.", "usd": 0.00125, "seconds": 1.14}, {"id": "3718195", "label": "real", "title": "wrong STARTTLS connection reuse", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific logic gap in connection reuse for STARTTLS protocols where SSL config verification is skipped due to missing PROTOPT_SSL flag, with clear code references and a plausible attack scenario.", "usd": 0.00077, "seconds": 1.29}, {"id": "3733905", "label": "real", "title": "trailing dot domain super cookie", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a specific, reproducible inconsistency in curl's PSL-based cookie domain handling for trailing-dot FQDNs versus canonical hostnames, including version details, a PoC script, and observed vulnerable behavior.", "usd": 0.00122, "seconds": 1.19}, {"id": "3721183", "label": "real", "title": "wrong reuse for different services", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report provides a detailed, reproducible scenario with specific code paths, version details, and evidence of an incomplete fix for a known CVE class, making it a credible vulnerability report rather than AI-generated slop.", "usd": 0.00208, "seconds": 1.4}, {"id": "3733910", "label": "real", "title": "incomplete mTLS config matching in conn reuse", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed technical analysis identifies a specific logic gap in mTLS connection reuse where client certificate key material and passphrase are not compared, supported by code references and a functional proof-of-concept.", "usd": 0.00207, "seconds": 1.34}, {"id": "3735193", "label": "real", "title": "SASL double-free", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible double-free bug in the GSASL authentication code with detailed code references, stack traces, and a reproducible trigger condition.", "usd": 0.00241, "seconds": 0.93}, {"id": "3750295", "label": "real", "title": "stale proxy password leak", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific logic bug in CURLOPT_PROXYUSERPWD introduced by a known commit, provides code analysis showing stale password retention, and includes version details and a PoC, making it a credible vulnerability report.", "usd": 0.00194, "seconds": 1.25}, {"id": "3752888", "label": "real", "title": "exposing HTTP/3 early data", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a specific logic flaw in the ngtcp2 HTTP/3 backend where early data is sent before peer verification completes during session reuse, includes a detailed code analysis pointing to exact lines in curl_ngtcp2.c, and provides a reproducible PoC script with certificates and server setup that demonstrates the vulnerability.", "usd": 0.00245, "seconds": 1.05}, {"id": "3744543", "label": "real", "title": "env-set cross-proxy Digest auth state leak", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a plausible incomplete fix for a known CVE class (CVE-2026-7168) where proxy auth state is cleared for CURLOPT_PROXY but not for environment-variable-driven proxy changes, includes a detailed local PoC, and shows a valid replay test against curl 8.20.0.", "usd": 0.00199, "seconds": 1.32}, {"id": "3749204", "label": "real", "title": "UAF after pause in socket callback", "verdict": "PLAUSIBLE", "confidence": 0.98, "headline": "Detailed, code-specific report with ASAN trace and reproducer showing a real use-after-free in multi_ev.c when curl_easy_pause is called from a socket callback.", "usd": 0.00281, "seconds": 1.36}, {"id": "3751697", "label": "real", "title": "HTTP/2 stream-dependency tree UAF", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible use-after-free in curl_easy_reset() where the HTTP/2 stream-dependency tree is not cleaned up before resetting the handle, provides a minimal reproducer, ASan output, and a targeted patch referencing real source files and commit history.", "usd": 0.00182, "seconds": 1.27}, {"id": "3751712", "label": "real", "title": "SSH improper host validation", "verdict": "PLAUSIBLE", "confidence": 0.98, "headline": "The report identifies a specific, verifiable logic error in lib/vssh/libssh.c where SSH_KNOWN_HOSTS_OTHER is incorrectly mapped to CURLKHMATCH_MISSING instead of CURLKHMATCH_MISMATCH, weakening TOFU security guarantees, and includes a detailed code analysis and reproducer.", "usd": 0.0021, "seconds": 1.29}, {"id": "3754343", "label": "real", "title": "sending old referer", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a specific, reproducible use-after-free and cross-request Referer leak in libcurl's CURLOPT_REFERER handling with a detailed proof-of-concept, indicating a genuine security issue rather than AI-generated slop.", "usd": 0.00198, "seconds": 1.32}, {"id": "3783438", "label": "real", "title": "QUIC zero-length UDP datagrams busy-loop", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible busy-loop vulnerability in curl's QUIC UDP receive logic with detailed code analysis, version history, and a reproducible end-to-end proof-of-concept.", "usd": 0.00232, "seconds": 1.34}, {"id": "3793260", "label": "real", "title": "cross-origin Digest auth state leak", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed technical report with working PoC demonstrating a plausible libcurl state management bug in Digest authentication across origins when reusing easy handles, distinct from previously fixed redirect/proxy issues.", "usd": 0.00208, "seconds": 1.23}, {"id": "3788931", "label": "real", "title": "WS Auto-PONG memory exhaustion", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report provides a detailed, reproducible proof-of-concept demonstrating a genuine memory exhaustion vulnerability in curl's default WebSocket auto-PONG handling, with specific code paths and version analysis.", "usd": 0.00186, "seconds": 1.44}, {"id": "3788984", "label": "real", "title": "Native CA trust persist", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a genuine logic bug where native_ca_store flag persists after switching to custom CA material, causing trust policy confusion in OpenSSL and Rustls backends.", "usd": 0.00178, "seconds": 1.46}, {"id": "3797526", "label": "real", "title": "proto-default skips SSH verification", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed technical report with specific code locations, commit history, and a working proof-of-concept demonstrating a real security bypass in curl's SSH host key verification when using --proto-default with schemeless URLs.", "usd": 0.00229, "seconds": 1.37}, {"id": "3822248", "label": "real", "title": "OpenLDAP SASL authentication bypass", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report provides a detailed, code-specific analysis of a logic flaw in curl's OpenLDAP SASL handling with a reproducible exploit against GSSAPI/Kerberos mutual authentication, indicating a genuine vulnerability rather than AI-generated slop.", "usd": 0.00232, "seconds": 1.38}, {"id": "3969255", "label": "real", "title": "OpenSSL provider use-after-free", "verdict": "PLAUSIBLE", "confidence": 0.92, "headline": "The report identifies a specific, plausible lifetime mismatch between the easy handle's OSSL_LIB_CTX and the pooled connection's SSL_CTX in OpenSSL 3.x provider mode, with a clear code trace and remediation options.", "usd": 0.0013, "seconds": 1.23}, {"id": "3916059", "label": "real", "title": "HTTP/2 server push UAF", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report provides a detailed, code-specific analysis of a use-after-free in curl's HTTP/2 server push handling with a reproducible test case and AddressSanitizer output, indicating a genuine vulnerability rather than AI-generated slop.", "usd": 0.00228, "seconds": 1.4}, {"id": "3969368", "label": "real", "title": "native CA store conn reuse", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible logic flaw in curl's SSL connection reuse on macOS where native_ca_store affects verification behavior but is not compared during config matching, causing silent security policy mismatches.", "usd": 0.00096, "seconds": 1.19}, {"id": "3969300", "label": "real", "title": "OpenSSL pinning bypass", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific logic flaw in Curl_ossl_check_peer_cert where pinned key verification is skipped when no peer certificate exists and --insecure is used, which is a plausible and serious bypass of a security feature.", "usd": 0.00126, "seconds": 1.23}, {"id": "3923520", "label": "real", "title": "Negotiate ambient user conn reuse", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific logic regression in curl 8.21.0's connection reuse logic for SSPI/Negotiate authentication on Windows, provides a clear root cause analysis with code context, includes a minimal reproducer and server, and proposes a targeted fix.", "usd": 0.00098, "seconds": 1.42}, {"id": "3972373", "label": "real", "title": "HSTS response erases persisted entries", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed technical analysis identifies a real regression in curl 8.2.0+ where HSTS cache truncation combined with gmtime serialization failure causes cross-origin policy loss, with reproducible steps and specific commit references.", "usd": 0.0019, "seconds": 1.15}, {"id": "3972357", "label": "real", "title": "HSTS cache import drops longer-lived child", "verdict": "PLAUSIBLE", "confidence": 0.98, "headline": "The report identifies a specific, reproducible logic error in curl's HSTS cache import code with a clear root cause, affected versions, and a minimal suggested fix.", "usd": 0.00141, "seconds": 1.22}, {"id": "3972395", "label": "real", "title": "secure cookie attribute bypass with tab", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible parsing regression in curl's cookie handling code with a clear root cause analysis, reproduction steps, and a suggested fix, making it a credible vulnerability report rather than AI-generated slop.", "usd": 0.00148, "seconds": 1.2}, {"id": "3972385", "label": "real", "title": "domain-scoped PSL domain cookie", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible logic error in curl's cookie handling when libpsl is used, provides a detailed root cause analysis with code references, and includes a reproducible test case demonstrating the RFC 6265 violation.", "usd": 0.0015, "seconds": 1.23}, {"id": "3972403", "label": "real", "title": "IMAP APPEND plus CRLF conversion command injection", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a concrete protocol framing mismatch in curl's IMAP APPEND implementation where CRLF conversion expands the transmitted body beyond the declared literal size, enabling command injection; it includes a precise root-cause analysis, a reproducible test case, and a suggested fix, making it a credible vulnerability report rather than AI-generated slop.", "usd": 0.00165, "seconds": 1.25}, {"id": "3972094", "label": "real", "title": "cross-origin reuse of a Negotiate connection", "verdict": "PLAUSIBLE", "confidence": 0.92, "headline": "The report provides a detailed technical analysis of a specific commit (bd10924b4) in curl's connection reuse logic, identifying a plausible flaw where NTLM and Negotiate authentication states are mishandled across origins behind a proxy, with reproducible steps and a clear impact scenario.", "usd": 0.00188, "seconds": 1.42}, {"id": "3975408", "label": "real", "title": "knownhost callback mismatches key as missing", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report provides specific code references, a detailed technical mechanism involving libssh2 known_hosts handling, and reproducible steps with a PoC, indicating a genuine vulnerability rather than AI-generated slop.", "usd": 0.00081, "seconds": 0.99}, {"id": "3973190", "label": "real", "title": "FTP connection reuse inherits client-certificate", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed technical analysis of a specific regression in curl's FTP connection reuse logic with precise code references and reproduction steps, indicating a genuine vulnerability report rather than AI-generated slop.", "usd": 0.00162, "seconds": 1.1}, {"id": "3973135", "label": "real", "title": "stale SigV4 headers sent unintended", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed, code-specific report identifying a real logic bug in CURLOPT_AWS_SIGV4 handling with reproduction steps and a matching fix pattern from the codebase.", "usd": 0.00182, "seconds": 1.17}, {"id": "3973176", "label": "real", "title": "redirect to SFTP or SCP bypasses host verification", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, plausible logic flaw in ssh_setopts() where an early return prevents SSH host verification options from being applied during HTTPS-to-SFTP redirects, includes detailed reproduction steps, and references a prior CVE fix that missed this variant.", "usd": 0.00161, "seconds": 1.22}, {"id": "3973090", "label": "real", "title": "wolfSSL CA-cache hit overrides callback", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed, code-specific analysis of a wolfSSL CA-cache logic flaw with reproducible steps and a precise fix, indicating a genuine vulnerability rather than AI-generated slop.", "usd": 0.00127, "seconds": 1.34}, {"id": "3973201", "label": "real", "title": "server-set cookie erases cookie jar", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a specific, reproducible logic bug in curl's cookie handling (inconsistent length limits between writer and loader, plus a state flag error causing destructive cleanup) with detailed code references and steps, not generic AI slop.", "usd": 0.00169, "seconds": 1.25}, {"id": "3989514", "label": "real", "title": "wolfSSL public-key pinning bypass", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report provides a detailed, reproducible proof-of-concept demonstrating a differential parsing vulnerability between wolfSSL and curl's internal X.509 parser that bypasses public-key pinning, which is a credible and specific security issue.", "usd": 0.00166, "seconds": 1.21}, {"id": "4021979", "label": "real", "title": "server-set cookie aborts cookie jar load", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed technical analysis with working PoC demonstrating a real inconsistency between cookie write and read limits that causes a denial-of-service via cookie jar corruption.", "usd": 0.00197, "seconds": 1.1}, {"id": "3993870", "label": "real", "title": "auto client cert connection reuse mixup", "verdict": "PLAUSIBLE", "confidence": 0.98, "headline": "Detailed, code-specific analysis of a real logic gap in curl's Schannel connection reuse matching `auto_client_cert` across redirects.", "usd": 0.00189, "seconds": 1.16}, {"id": "4022003", "label": "real", "title": "never-ending loop via server response omission", "verdict": "PLAUSIBLE", "confidence": 0.92, "headline": "The report identifies a specific, plausible logic flaw in Curl_pp_readresp() where an unbounded loop processes server responses without checking transfer timeouts, potentially allowing a malicious server to hang the event loop indefinitely.", "usd": 0.00203, "seconds": 1.06}, {"id": "3993549", "label": "real", "title": "Negotiate credentials sent to redirected origin", "verdict": "PLAUSIBLE", "confidence": 0.98, "headline": "Detailed, code-specific analysis identifies a logic flaw where URL-embedded credentials bypass cross-host authentication checks during redirects, enabling Kerberos token leakage to attacker-controlled hosts.", "usd": 0.00225, "seconds": 1.27}, {"id": "3993566", "label": "real", "title": "leaking host credentials to HTTP proxy", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a specific, plausible logic flaw in curl's HTTP CONNECT handling where a malicious proxy can trick curl into sending origin credentials by responding with 401/WWW-Authenticate instead of 407/Proxy-Authenticate, supported by code references and a working proof-of-concept.", "usd": 0.0021, "seconds": 1.31}, {"id": "4040551", "label": "real", "title": "Authorization: Negotiate sent to foreign origin", "verdict": "PLAUSIBLE", "confidence": 0.98, "headline": "Detailed technical analysis with specific code references demonstrating a logic flaw in credential handling during redirects that bypasses origin checks for Negotiate authentication.", "usd": 0.00202, "seconds": 1.07}, {"id": "4022070", "label": "real", "title": "FTP wildcard write callback mixup", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed, code-specific analysis of a state-restoration bug in FTP wildcard handling with reproducible ASan findings and a demonstrated write primitive, indicating a genuine vulnerability.", "usd": 0.0019, "seconds": 1.19}, {"id": "4022568", "label": "real", "title": "TFTP direction confusion", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a specific, plausible logic flaw in curl's TFTP state machine with code references, RFC citations, impact analysis, and a working proof-of-concept demonstrating cross-transfer data leakage via handle reuse.", "usd": 0.00226, "seconds": 1.2}, {"id": "4024222", "label": "real", "title": "curl_mime_free stack overflow by recursion", "verdict": "PLAUSIBLE", "confidence": 0.98, "headline": "The report identifies a genuine missing recursion depth guard in curl_mime_free and related cleanup functions, provides accurate code references, and includes a working proof-of-concept demonstrating a stack overflow.", "usd": 0.00193, "seconds": 1.18}, {"id": "4030333", "label": "real", "title": "HTTP/2 upload Use-After-Free", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report provides a detailed, code-specific analysis of a use-after-free vulnerability in curl's HTTP/2 handling with a reproducible test case and ASAN verification, indicating a genuine security issue rather than AI-generated slop.", "usd": 0.00213, "seconds": 1.18}, {"id": "4023192", "label": "real", "title": "-J no-clobber guarantee bypassed with 103 early hints", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed, technically specific report with a working proof-of-concept demonstrating a real bypass of curl's documented -J no-clobber guarantee via 103 Early Hints and -i interaction, consistent with prior CVE-2020-8177 class.", "usd": 0.00192, "seconds": 1.21}, {"id": "4099618", "label": "real", "title": "local interface connection reuse mixup", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed technical analysis with specific code locations, version history, and reproducible test cases demonstrating a genuine connection reuse bug in CURLOPT_INTERFACE prefixed forms.", "usd": 0.0019, "seconds": 1.02}, {"id": "4099194", "label": "real", "title": "info leak uploading over WebSockets with GnuTLS", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "Detailed technical report with specific code paths, GnuTLS behavior analysis, and reproducible PoC demonstrating a genuine out-of-bounds read in gtls_send() when handling WebSocket PING/PONG during blocked uploads.", "usd": 0.00235, "seconds": 1.14}, {"id": "550696", "label": "real", "title": "Heap Buffer Overflow at lib/tftp.c", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report identifies a specific code location and a plausible logic error where a user-supplied option (--tftp-blksize) might not update the internal state variable (state->blksize) used for the recvfrom buffer size, creating a potential heap overflow if the user requests a smaller block size than the default.", "usd": 0.00067, "seconds": 1.15}, {"id": "4041053", "label": "real", "title": "password leak in CURLINFO_EFFECTIVE_URL", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report identifies a specific, reproducible code path where .netrc credentials persist in the URL handle across relative redirects and are exposed via CURLINFO_EFFECTIVE_URL, verbose output, and write-out variables, which is a genuine confidentiality bug.", "usd": 0.00194, "seconds": 1.24}, {"id": "547630", "label": "real", "title": "An integer overflow found in /lib/urlapi.c", "verdict": "PLAUSIBLE", "confidence": 0.7, "headline": "The report identifies a plausible integer overflow in `urllen * 2 + 2` on 32-bit systems when `urllen` approaches SIZE_MAX/2, which is a valid code pattern to audit even if practical exploitation is unlikely.", "usd": 0.001, "seconds": 1.19}, {"id": "608577", "label": "real", "title": "Windows Privilege Escalation: Malicious OpenSSL Engine", "verdict": "PLAUSIBLE", "confidence": 0.9, "headline": "The report describes a plausible DLL search-order / OpenSSL engine hijack via a writable default OPENSSLDIR path (c:\\usr\\local\\ssl) that low-privileged users can create, which is a known class of Windows privilege-escalation issue affecting applications that load OpenSSL engines from a fixed, user-writable directory.", "usd": 0.00103, "seconds": 1.29}, {"id": "686823", "label": "real", "title": "krb5: double-free in read_data() after realloc() fail", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies a specific code path in lib/security.c where a realloc failure could lead to a double-free, provides a plausible trigger mechanism, and acknowledges the bug was introduced by a specific commit, warranting maintainer investigation.", "usd": 0.00063, "seconds": 1.0}, {"id": "874778", "label": "real", "title": "Partial password leak over DNS on HTTP redirect", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report demonstrates a real credential leak via DNS when curl follows a relative redirect with a userinfo-containing URL, which is a known class of bug in curl's redirect handling.", "usd": 0.00202, "seconds": 1.02}, {"id": "948876", "label": "real", "title": "Connect-only connections can use the wrong connection", "verdict": "PLAUSIBLE", "confidence": 0.95, "headline": "The report describes a specific, plausible use-after-free logic bug in curl's connection cache triggered by custom memory allocators and connect-only handles, includes a minimal reproducer, and identifies a suspect commit.", "usd": 0.00215, "seconds": 1.01}, {"id": "684603", "label": "real", "title": "Heap buffer overflow in TFTP when using small blksize", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report describes a specific logic flaw in curl's TFTP block size handling introduced by a known CVE fix, provides a clear reproduction scenario, and suggests a plausible fix, indicating a genuine bug rather than AI-generated slop.", "usd": 0.00076, "seconds": 1.51}, {"id": "887462", "label": "real", "title": "curl overwrite local file with -J", "verdict": "PLAUSIBLE", "confidence": 0.85, "headline": "The report identifies two specific logic bugs in curl's argument parsing and header callback handling that interact to bypass the existing-file check, which is a plausible vulnerability requiring maintainer investigation.", "usd": 0.00094, "seconds": 1.4}], "factcheck": {"baseline_closes": 31, "closes_with_false_reason": 13, "claims": [{"id": "2298307", "baseline_said": "lib/ws.c does not exist", "fact": "lib/ws.c exists at e251e858b941", "baseline_reason": "The report references a non-existent file (lib/ws.c) and function (strcpy at line 581) in the curl codebase, indicating fabricated vulnerability details."}, {"id": "3392174", "baseline_said": "curl has no lib/ws.c", "fact": "lib/ws.c exists at b4f57c804573", "baseline_reason": "The report claims a buffer overflow in lib/ws.c at line 1287, but curl's source tree has no lib/ws.c file and the WebSocket implementation lives in lib/vwebsocket.c with a different handshake flow; the cited code snippet, version string (8.7.1), and exploit do not match the real codebase."}, {"id": "2199174", "baseline_said": "curl_easy_setopt does not exist in curl", "fact": "curl_easy_setopt appears in 11 files at f64ecb2bc0db, e.g. include/curl/curl.h", "baseline_reason": "The report describes a non-existent CVE (CVE-2023-38545), invents a function `curl_easy_setopt` that does not exist in curl, cites a fake commit hash and version 8.4.0, and claims an LLM disclosed secret fix details, all hallmarks of AI-generated fabrication."}, {"id": "2199174", "baseline_said": "CVE-2023-38545 does not exist", "fact": "CVE-2023-38545 is a real curl SOCKS5 heap overflow (https://curl.se/docs/CVE-2023-38545.html)", "baseline_reason": "The report describes a non-existent CVE (CVE-2023-38545), invents a function `curl_easy_setopt` that does not exist in curl, cites a fake commit hash and version 8.4.0, and claims an LLM disclosed secret fix details, all hallmarks of AI-generated fabrication."}, {"id": "2887487", "baseline_said": "inet_ntop4 does not exist", "fact": "inet_ntop4 appears in 1 files at 59fec5ac43ad, e.g. lib/inet_ntop.c", "baseline_reason": "The report invents a non-existent `inet_ntop4` function and misrepresents `Curl_inet_ntop`; the real code uses `curlx_inet_ntop` which already validates buffer size and uses safe string functions."}, {"id": "3462525", "baseline_said": "curl_msprintf does not exist", "fact": "curl_msprintf appears in 3 files at fe8393d7db8c, e.g. include/curl/mprintf.h", "baseline_reason": "The report describes a non-existent function curl_msprintf in lib/mprintf.c; the actual code uses curl_mprintf with a size parameter and bounds-checked callbacks, making the described overflow impossible."}, {"id": "3466896", "baseline_said": "Curl_ipv4_resolve_r does not exist", "fact": "Curl_ipv4_resolve_r appears in 4 files at 7b2783496ce7, e.g. lib/amigaos.c", "baseline_reason": "The report invents a non-existent function `Curl_ipv4_resolve_r` and file `amigaos.c`; curl's AmigaOS code lives in `lib/amiga.c` and uses `Curl_getaddrinfo_ex` with `getaddrinfo`, not the described `gethostbyname_r` API, making the entire technical analysis fabricated."}, {"id": "3466896", "baseline_said": "amigaos.c does not exist", "fact": "lib/amigaos.c exists at 7b2783496ce7", "baseline_reason": "The report invents a non-existent function `Curl_ipv4_resolve_r` and file `amigaos.c`; curl's AmigaOS code lives in `lib/amiga.c` and uses `Curl_getaddrinfo_ex` with `getaddrinfo`, not the described `gethostbyname_r` API, making the entire technical analysis fabricated."}, {"id": "3466883", "baseline_said": "curl has no Alt-Svc header parser", "fact": "lib/altsvc.c exists at 7b2783496ce7", "baseline_reason": "The report invents a non-existent 'Alt-Svc' header parser, fake CVE details, impossible version ranges (7.64.0-7.89.0), and includes a full ROP exploit payload, all of which are fabrications that do not exist in the curl codebase."}, {"id": "3249936", "baseline_said": "the Transfer-Encoding header is invented", "fact": "Transfer-Encoding appears in 8 files at 9bdd08b3b22a, e.g. lib/cf-h1-proxy.c", "baseline_reason": "The report invents a non-existent 'Transfer-Encoding' header and 'http_req_set_reader()' function, misstates the cURL version as 8.4.0, and describes a client-side request smuggling scenario that is not a vulnerability in cURL itself."}, {"id": "3125832", "baseline_said": "ngtcp2 is a fake library", "fact": "ngtcp2 appears in 8 files at e1f87a093b71, e.g. lib/Makefile.inc", "baseline_reason": "The report invents a non-existent HTTP/3 protocol, a fake ngtcp2 library, and a patched aioquic server to claim a cyclic stream dependency crash in curl, none of which exist in the real codebase."}, {"id": "2823554", "baseline_said": "__strcpy_evex and CRYPTO_strdup are invented names", "fact": "CRYPTO_strdup is a documented OpenSSL function (https://docs.openssl.org/master/man3/OPENSSL_malloc/)", "baseline_reason": "The report describes a generic buffer overflow in OpenSSL's libcrypto.so with invented function names like __strcpy_evex and CRYPTO_strdup, contains no curl-specific code paths, and reads like a textbook exploit tutorial rather than a genuine vulnerability in curl."}, {"id": "2871792", "baseline_said": "__strcpy_evex and CRYPTO_strdup are impossible function names", "fact": "CRYPTO_strdup is a documented OpenSSL function (https://docs.openssl.org/master/man3/OPENSSL_malloc/)", "baseline_reason": "The report contains a fabricated stack trace with impossible function names like __strcpy_evex and CRYPTO_strdup, references non-existent curl functions and memory addresses, and describes a generic textbook buffer overflow exploit that does not correspond to any actual curl codebase."}, {"id": "3335085", "baseline_said": "http.server and ssl.SSLContext are imaginary Python modules", "fact": "http.server is in the Python standard library (https://docs.python.org/3/library/http.server.html)", "baseline_reason": "The PoC uses non-existent OpenSSL subcommands (genrsa, req -x509) and imaginary Python modules (http.server, ssl.SSLContext), proving the exploit code is AI-hallucinated and cannot execute."}, {"id": "3158093", "baseline_said": "libnghttp3-dev and libpsl-dev are fake package names", "fact": "both are Debian packages (https://packages.debian.org/search?keywords=libpsl-dev)", "baseline_reason": "The report contains multiple fabrications including a non-existent curl version 8.14.0-DEV, fake package names like libnghttp3-dev and libpsl-dev, an invalid HTTP 302 status code, a non-existent --location flag, and references to source files that do not handle Location headers in the described manner."}]}}} |