The curl project, which became a CNA (CVE Numbering Authority) several years ago, resolved its first-ever CVE dispute on June 24, 2026. The dispute centered on whether a technical bug discovered in curl’s hostname validation function merited a CVE identifier.
The disputed issue involved a flaw in curl’s wildcard certificate hostname checking, according to the source. The bug only manifested under an extremely specific set of circumstances: a user would need to use a hostname with a leading dot (such as https://.example.com/) in a URL. Such names cannot be resolved through standard DNS and would require manual configuration through files like /etc/hosts or a local attacker’s intervention.
Further, the connection would need to reach a host with a wildcard certificate matching that unusual name structure, and the attacker would need to have successfully set up that impostor host. Curl was fixed on December 8, 2025, with unit tests added to prevent regression.
The curl project determined this constituted a “lower than LOW” severity issue—one with such extreme requirements and convoluted steps that practical risk to users was negligible. The team emphasized that curl runs on approximately thirty billion instances globally, meaning each published CVE triggers significant work across many security teams worldwide. According to the source, the project aimed to act responsibly by not raising alarms for theoretical problems unlikely to manifest in practice.
The reporter appealed to MITRE, requesting CVE assignment. After three separate inquiries from MITRE (in February, May, and June 2026), the MITRE TL-Root issued a final determination agreeing with curl’s assessment. The authority concluded the issue was “a bug, now fixed” that is “not considered a security vulnerability because of how it requires a local attacker with privileges present to make it so.”
Key facts
- Curl became a CNA and published 57 CVEs in the years leading up to this dispute
- The disputed bug required a hostname with a leading dot, which cannot be resolved via normal DNS
- The issue required multiple unlikely conditions: manual hostname configuration, a host with a matching wildcard certificate, and an attacker-controlled server
- MITRE rejected the CVE dispute request after three separate inquiries from the reporter
- The curl team emphasizes the ecosystem cost of CVEs, given the software’s 30 billion installed instances