To this day two vulnerabilities are known in curl 7.57.0. Both are related to HTTP:
- HTTP authentication leak in redirects
- HTTP/2 trailer out-of-bounds read
My application uses this version of curl and communicates with a single hardcoded web server. The server has a well-known domain name and is controlled by a trusted company. Is the application vulnerable to these vulnerabilities given that HTTPS is always used?