ROLE=fixed ATTEMPT=2 BINARY=/pruva/project-cache/cve-2026-82209/build-fixed/src/curl PORT=33793 curl 8.22.0-DEV (Linux) libcurl/8.22.0-DEV zlib/1.3.1 brotli/1.2.0 zstd/1.5.7 libidn2/2.3.8 libpsl/0.21.2 libssh2/1.11.1 nghttp2/1.68.0 OpenLDAP/2.6.10 Release-Date: [unreleased] Protocols: dict file ftp gopher http imap ipfs ipns ldap mqtt pop3 rtsp scp sftp smtp telnet tftp ws Features: alt-svc AsynchDNS brotli HTTP2 IDN IPv6 Largefile libz PSL threadsafe UnixSockets zstd --- HTTP exchange --- * [DNS] added github.io:33793:127.0.0.1 to cache * [DNS] added attacker.github.io:33793:127.0.0.1 to cache * Hostname github.io was found in DNS cache * Host github.io:33793 was resolved. * IPv6: (none) * IPv4: 127.0.0.1 * Trying 127.0.0.1:33793... * Established connection to github.io (127.0.0.1 port 33793) from 127.0.0.1 port 33530 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 0* using HTTP/1.x > GET /set HTTP/1.1 > Host: github.io:33793 > User-Agent: curl/8.22.0-DEV > Accept: */* > * Request completely sent off < HTTP/1.1 200 OK < Server: BaseHTTP/0.6 Python/3.14.4 < Date: Thu, 03 Sep 2026 13:35:32 GMT * Added cookie sid="DOMAIN_SECRET" for domain github.io, path /, expire 0 < Set-Cookie: sid=DOMAIN_SECRET; Domain=github.io; Path=/ < Content-Length: 3 < Connection: close < { [3 bytes data] 100 3 100 3 0 0 2189 0 0 100 3 100 3 0 0 2152 0 0 100 3 100 3 0 0 2129 0 0 * shutting down connection #0 ok * RESOLVE github.io:33793 - old addresses discarded * [DNS] added github.io:33793:127.0.0.1 to cache * RESOLVE attacker.github.io:33793 - old addresses discarded * [DNS] added attacker.github.io:33793:127.0.0.1 to cache * Hostname attacker.github.io was found in DNS cache * Host attacker.github.io:33793 was resolved. * IPv6: (none) * IPv4: 127.0.0.1 * Trying 127.0.0.1:33793... * Established connection to attacker.github.io (127.0.0.1 port 33793) from 127.0.0.1 port 33544 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 0* using HTTP/1.x > GET /sibling HTTP/1.1 > Host: attacker.github.io:33793 > User-Agent: curl/8.22.0-DEV > Accept: */* > * Request completely sent off < HTTP/1.1 200 OK < Server: BaseHTTP/0.6 Python/3.14.4 < Date: Thu, 03 Sep 2026 13:35:32 GMT < Content-Length: 3 < Connection: close < { [3 bytes data] 100 3 100 3 0 0 4137 0 0 100 3 100 3 0 0 4054 0 0 100 3 100 3 0 0 3984 0 0 * shutting down connection #1 ok * RESOLVE github.io:33793 - old addresses discarded * [DNS] added github.io:33793:127.0.0.1 to cache * RESOLVE attacker.github.io:33793 - old addresses discarded * [DNS] added attacker.github.io:33793:127.0.0.1 to cache * Hostname github.io was found in DNS cache * Host github.io:33793 was resolved. * IPv6: (none) * IPv4: 127.0.0.1 * Trying 127.0.0.1:33793... * Established connection to github.io (127.0.0.1 port 33793) from 127.0.0.1 port 33546 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 0* using HTTP/1.x > GET /origin-check HTTP/1.1 > Host: github.io:33793 > User-Agent: curl/8.22.0-DEV > Accept: */* > Cookie: sid=DOMAIN_SECRET > * Request completely sent off < HTTP/1.1 200 OK < Server: BaseHTTP/0.6 Python/3.14.4 < Date: Thu, 03 Sep 2026 13:35:32 GMT < Content-Length: 3 < Connection: close < { [3 bytes data] 100 3 100 3 0 0 4746 0 0 100 3 100 3 0 0 4601 0 0 100 3 100 3 0 0 4511 0 0 * shutting down connection #2 ok CURL_EXIT=0