H1-3680680 — Vulnetix

H1-3680680 PUBLISHED

libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms

Exploit Intelligence

libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms (hackerone)
libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms (hackerone)

Timeline

Apr 19, 2026 CVE Published
Apr 19, 2026 PoC Published

References

libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms advisory

Open in Interactive Console →

$ Console Community · 100/wk Open console ›