Riskcovery

CVE-2026-6429

netrc credential leak with reused proxy connection

State
Published
Severity
5.3 Medium
Published
May 13, 2026
Updated
Sep 15, 2026
Reserved
Apr 16, 2026

Read the record on cve.org

Description

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NCISA-ADP

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
curlcurl
  • 7.14.0 to before 8.14.2Affected
  • 8.15.0 to before 8.16.1Affected
  • 8.17.0 to before 8.20.0Affected
curlcurl
  • 01165e08e0d131b399fba2190f17af67e66f0888 to before b4024bf808bd558026fdc6096e8457f199ace306Affected
curlcurl
  • 8.19.0Affected
  • 8.18.0Affected
  • 8.17.0Affected
  • 8.16.0Affected
  • 8.15.0Affected
  • 8.14.1Affected
  • 8.14.0Affected
  • 8.13.0Affected
  • 8.12.1Affected
  • 8.12.0Affected
  • 8.11.1Affected
  • 8.11.0Affected
  • 8.10.1Affected
  • 8.10.0Affected
  • 8.9.1Affected
  • 8.9.0Affected
  • 8.8.0Affected
  • 8.7.1Affected
  • 8.7.0Affected
  • 8.6.0Affected
  • 8.5.0Affected
  • 8.4.0Affected
  • 8.3.0Affected
  • 8.2.1Affected
  • 8.2.0Affected
  • and 133 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.