{“lastseen”:”2026-01-20T07:28:01″,”description”:”## Summary:\\nThe SSL options ISSUERCERT, EC_CURVES and CRLFILE are silently ignored for e.g. the mbedTLS backend, which allows MITM attacks for the ISSUERCERT and CRLFILE bug, and can reduce the security and compliance by ignoring the specified curve for the EC_CURVES bug. \\n\\n## Affected version\\nTested with latest master version, commit 2d5a063121202acaa23bb77975b2739bec4551ce, and mbedTLS 3.6 and 4.0.\\n\\n## Steps To Reproduce:\\nInstall Docker on a Linux system, and run the test.sh script. It compiles 2 versions of curl: with mbedTLS, and with OpenSSL. It then tests all 3 bugs with a custom C program which is needed for the bug, and in addition the EC_CURVES bug from the command line. Expected output:\\n\\n“`\\n=== mbedTLS ===\\n===========================================\\ncurl 8.19.0-DEV (mbedTLS\/4.0.0)\\n===========================================\\n\\n— CURLOPT_ISSUERCERT —\\n Setting: \\”fake_issuer.pem\\”\\n setopt: No error\\n perform: No error\\n Result: VULNERABLE – silently ignored!\\n\\n— CURLOPT_SSL_EC_CURVES —\\n Setting: \\”INVALID_CURVE_NAME\\”\\n setopt: No error\\n perform: No error\\n Result: VULNERABLE – silently ignored!\\n\\n— CURLOPT_CRLFILE —\\n Setting: \\”fake_crl.pem\\”\\n setopt: No error\\n perform: Failed to load CRL file (path? access rights?, format?)\\n Result: CORRECT – CRL check enforced\\n\\n===========================================\\nSUMMARY\\n===========================================\\n CURLOPT_ISSUERCERT VULNERABLE\\n CURLOPT_SSL_EC_CURVES VULNERABLE\\n CURLOPT_CRLFILE OK\\n\\nFOUND 2 VULNERABILITIES\\n\\n=== OpenSSL ===\\n===========================================\\ncurl 8.19.0-DEV (OpenSSL\/3.0.13)\\n===========================================\\n\\n— CURLOPT_ISSUERCERT —\\n Setting: \\”fake_issuer.pem\\”\\n setopt: No error\\n perform: Issuer check against peer certificate failed\\n Result: CORRECT – issuer check enforced\\n\\n— CURLOPT_SSL_EC_CURVES —\\n Setting: \\”INVALID_CURVE_NAME\\”\\n setopt: No error\\n perform: Could not use specified SSL cipher\\n Result: CORRECT – EC curve validated\\n\\n— CURLOPT_CRLFILE —\\n Setting: \\”fake_crl.pem\\”\\n setopt: No error\\n perform: Failed to load CRL file (path? access rights?, format?)\\n Result: CORRECT – CRL check enforced\\n\\n===========================================\\nSUMMARY\\n===========================================\\n CURLOPT_ISSUERCERT OK\\n CURLOPT_SSL_EC_CURVES OK\\n CURLOPT_CRLFILE OK\\n\\nNo vulnerabilities found.\\n\\n########################################\\n# CLI TEST (–curves)\\n########################################\\n\\n=== mbedTLS CLI ===\\nRunning: curl –curves INVALID_CURVE https:\/\/curl.se\\n200 -\\u003e VULNERABLE (silently ignored)\\n\\n=== OpenSSL CLI ===\\nRunning: curl –curves INVALID_CURVE https:\/\/curl.se\\n000 -\\u003e CORRECT (rejected invalid curve)\\n\\n########################################\\n# RESULT\\n########################################\\n\\nVULNERABILITIES CONFIRMED: mbedTLS ignores SSL options that OpenSSL enforces\\n“`\\n\\nIt probably is also a problem for Windows with the Schannel backend, but I didn’t test this.\\n\\n## Supporting Material\/References:\\n\\nAttached files:\\n\\n- `Dockerfile`: Builds curl with both mbedTLS and OpenSSL backends\\n- `test_ssl_options.c`: Test program for all SSL options\\n- `run_test.sh`: Test script (runs inside container)\\n- `test.sh`: Build and run (host entry point)\\n\\nThe fix should be easy: Return `CURLE_NOT_BUILT_IN` for backends that don’t implement these features.\\n\\n“`c\\ncase CURLOPT_ISSUERCERT:\\n if(!Curl_ssl_supports(data, SSLSUPP_ISSUERCERT))\\n return CURLE_NOT_BUILT_IN;\\n return Curl_setstropt(\\u0026data-\\u003eset.str[STRING_SSL_ISSUERCERT], va_arg(param, char *));\\n“`\\n\\nThis requires:\\n1. Adding feature flags (e.g., `SSLSUPP_ISSUERCERT`, `SSLSUPP_EC_CURVES`) to the SSL backend interface\\n2. Each backend declaring which features it supports\\n3. Checking support before accepting the option\\n\\n## Impact\\n\\n## Summary \\n \\n### MITM Attack Enablement\\nApplications and scripts that rely on `CURLOPT_ISSUERCERT` or `CURLOPT_CRLFILE` for certificate validation are vulnerable to MITM attacks when built against affected backends. An attacker with any valid certificate can intercept supposedly-pinned connections. \\n \\n### Cryptographic Downgrade\\nThe `CURLOPT_SSL_EC_CURVES`\/`–curves` option being ignored allows servers (or MITM attackers) to negotiate weaker elliptic curves than intended, potentially exploiting known cryptographic weaknesses. \\n \\n### Silent Failure\\nThe most critical aspect is that these options fail silently, returning `CURLE_OK` and proceeding without the security check. Applications have no way to detect that their security requirements are not being enforced. \\n \\n## Affected Platforms \\nAll systems which use affected backends. For example OpenWrt (which replaced WolfSSL with mbedTLS in newer releases), Windows builds using Schannel, and many IoT devices and Docker containers. WolfSSL probably has the same bug.\\n\\n## Attack Surface\\nThe bugs affect both libcurl applications (via `curl_easy_setopt()`) and curl command line users (via `–curves` and `–crlfile` flags). Two of three vulnerabilities are exploitable from the CLI, not just custom programs.”,”published”:”2026-01-19T20:10:19″,”modified”:”2026-01-20T06:48:21″,”type”:”hackerone”,”title”:”curl: SSL options ISSUERCERT, EC_CURVES and CRLFILE silently ignored by non-OpenSSL backends”,”source”:””,”references”:””,”id”:”H1:3516974″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3516974″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-20T07:28:01″,”description”:”## Summary:\\nThe SSL options ISSUERCERT, EC_CURVES and CRLFILE are silently ignored for e.g. the mbedTLS backend, which allows MITM attacks for the ISSUERCERT and CRLFILE…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-36402","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n