# CVE-2022-43551: Another HSTS bypass via IDN

curl stores HSTS entries IDN-encoded but looks them up IDN-decoded, so a hostname with U+3002 full stop bypasses HSTS and forces cleartext HTTP.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: kurohiro
- Disclosed: 2023-02-03
- CVE: CVE-2022-43551
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1813831
- Library page: https://bugbountylibrary.com/r/h1%3A1813831
- Tags: area:oss domain:oss impact:integrity kind:bounty platform:hackerone sev:medium tech:curl technique:incomplete-fix technique:unicode-normalization vuln:misconfiguration

**Target:** curl HSTS cache / IDN hostname handling
**Root cause:** HSTS state is stored using the IDN-encoded hostname but queried using the IDN-decoded hostname, so the lookup misses and HSTS is not enforced.
**Steps:**
1. `curl --hsts hsts.txt https://curl%E3%80%82se` (U+3002 ideographic full stop) stores HSTS entry IDN-encoded
2. `curl --hsts hsts.txt http://curl%E3%80%82se` looks up IDN-decoded name, misses HSTS, performs cleartext HTTP
**How found:** Follow-up research after fixing prior HSTS IDN bypasses (CVE-2022-42916, CVE-2022-30115); testing related side-issues revealed the encode/decode mismatch in HSTS storage vs lookup.
**Insight:** When a security state (HSTS, cookies, allowlists) is keyed by hostname, verify the same normalization is applied on both write and read paths; IDN/punycode and Unicode dot variants are prime differentials.