# CVE-2022-30115: HSTS bypass via trailing dot

curl's HSTS cache keyed hostnames inconsistently with trailing dots, letting a URL with a trailing dot bypass HSTS and stay on cleartext HTTP.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: haxatron1
- Disclosed: 2022-06-11
- CVE: CVE-2022-30115
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1565622
- Library page: https://bugbountylibrary.com/r/h1%3A1565622
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:medium tech:curl technique:source-review vuln:info-disclosure vuln:misconfiguration

**Target:** libcurl HSTS enforcement / hostname handling
**Root cause:** HSTS cache lookups and URL hostnames were compared without normalizing trailing dots, so a hostname with a trailing dot did not match the cached HSTS entry stored without one (or vice versa).
**Steps:**
1. Use curl 7.82.0-7.83.0 with HSTS enabled (`--hsts <file>`).
2. Populate HSTS cache for `example.com` (e.g. via prior HTTPS response with Strict-Transport-Security).
3. Request `http://example.com./` (trailing dot) — HSTS match fails, curl proceeds over cleartext HTTP.
4. Observe sensitive data sent unencrypted despite HSTS policy.
**How found:** Researcher noted trailing-dot hostnames are treated as equivalent by many sites and tested whether curl's HSTS cache keying normalized them; prior similar Firefox/Chrome bugs hinted at the class.
**Exploitation:** Attacker positioned to influence a URL (or rely on user-supplied URL with trailing dot) causes curl to skip the HSTS upgrade and transmit over cleartext HTTP, enabling network eavesdropping.
**Insight:** When a security policy is keyed on hostnames, test canonicalization edge cases (trailing dot, case, IDN/punycode, percent-encoding) against the enforcement path — mismatched normalization between cache-write and cache-read silently disables the policy.