Technology

MITRE rules in favor of curl in its first-ever CVE dispute

An adjudicating body upheld the curl project's decision that a niche wildcard hostname bug did not rise to the level of a security vulnerability.

Updated Aug 31, 2026 · 12:19 UTC1 reports

The short version

The curl project, acting as its own CVE Numbering Authority, has resolved its first-ever CVE dispute after a reporter appealed a rejected vulnerability claim to MITRE.
The dispute centered on a minor, technical bug in curl's wildcard hostname checking function that developers determined did not warrant a CVE.
On June 24, 2026, MITRE's TL-Root ruled in favor of curl, finalizing the decision to deny the assignment of a CVE.

The curl project acts as its own CVE Numbering Authority (CNA), which allows it to independently evaluate and assign CVEs for its own codebase.[Hacker News]
On February 10, 2026, curl received its first-ever CVE dispute after a reporter escalated a rejected report to MITRE.[Hacker News]
The underlying bug involved curl's Curl_cert_hostcheck function, which erroneously returned a wildcard hostname match when using OpenSSL or Schannel with a hostname containing an illegal leading dot.[Hacker News]
Curl developers patched the bug on December 8, 2025, but argued it did not warrant a CVE because exploiting it required an extremely unlikely set of circumstances, including a local attacker with privileges.[Hacker News]
MITRE consulted with curl multiple times throughout the first half of 2026 before issuing a final determination in June 2026 that sided with curl and declined to issue a CVE.[Hacker News]