Let me give you another peek into the everyday work of the #curl security team. A reported UAF we deem not a security problem:
HackerOnecurl disclosed on HackerOne: Use after free (read) in...## Summary:
[summary of the vulnerability]
There is a use after free in `curl_multi_perform` when DoH resolver timeouts and `CURLOPT_PROXY` is used (see reproducer and stack trace)
I found it via fuzzing with https://github.com/catenacyber/curl-fuzzer/tree/proxy (after fixing a small memory leak in curl)
Another reproducer was found with curl_fuzzer_mqtt
(I have other fuzzers reports)
##...
