When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
CVSS Details
- CVSS 3.1 Base Score: 3.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mysql-testUpgrade mysql-develUpgrade mysqlUpgrade mysql-serverUpgrade mecabUpgrade mecab-develUpgrade mecab-ipadicUpgrade mysql-errmsgUpgrade mecab-ipadic-EUCJPUpgrade mysql-commonUpgrade mysql-libs | Feb 21, 2025 | Dec 11, 2024 |
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Dec 11, 2024 |
| Amazon_linux_2023 | — | Upgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade curl-debugsourceUpgrade curlUpgrade curl-minimal-debuginfoUpgrade libcurlUpgrade libcurl-debuginfoUpgrade curl-minimalUpgrade curl-debuginfoUpgrade libcurl-devel | Jan 12, 2026 | Dec 11, 2024 |
| Debian | — | Upgrade curl | Mar 17, 2025 | Dec 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Apr 11, 2025 | Dec 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | Mar 19, 2025 | Dec 11, 2024 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory7 | Nov 6, 2025 | Jun 4, 2025 |
| Oracle Httpserver | — | Apply patch 37677581 to Oracle HTTP Server 12.2.1.4.0.Apply patch 37658370 to Oracle HTTP Server 14.1.2.0.0. | Sep 30, 2026 | Dec 11, 2024 |
| Oracle Mysql | — | Upgrade to MySQL version 9.2.0Upgrade to MySQL version 8.4.4Upgrade to MySQL version 8.0.41 | Jan 22, 2025 | Dec 11, 2024 |
| Oracle_linux | — | Upgrade mysql-develUpgrade mysql-serverUpgrade mecab-ipadic-EUCJPUpgrade mysql-commonUpgrade mysql-libsUpgrade mecab-develUpgrade mysqlUpgrade mysql-errmsgUpgrade mecabUpgrade mecab-ipadicUpgrade mysql-test | Feb 25, 2025 | Dec 11, 2024 |
| Redhat_linux | — | Upgrade mysql-libsUpgrade mysql-serverUpgrade mysql-debugsourceUpgrade mysql-server-debuginfoUpgrade mysql-devel-debuginfoUpgrade mecab-debugsourceUpgrade mecab-develUpgrade mysql-develUpgrade mecab-ipadicUpgrade mecab-ipadic-EUCJPUpgrade mecab-debuginfoUpgrade mysql-errmsgUpgrade mysql-testUpgrade mysql-test-debuginfoNo solution existsUpgrade mysql-debuginfoUpgrade mysql-commonUpgrade mysqlUpgrade mecabUpgrade mysql-libs-debuginfo | Feb 20, 2025 | Dec 11, 2024 |
| Rocky_linux | — | Upgrade mysql-test-debuginfoUpgrade mecab-ipadic-EUCJPUpgrade mysql-commonUpgrade mysql-debuginfoUpgrade mysql-server-debuginfoUpgrade mecab-ipadicUpgrade mecab-debuginfoUpgrade mysql-libsUpgrade mecab-develUpgrade mysql-testUpgrade mysql-serverUpgrade mysql-develUpgrade mysql-libs-debuginfoUpgrade mysql-devel-debuginfoUpgrade mecab-debugsourceUpgrade mecabUpgrade mysql-errmsgUpgrade mysql-debugsourceUpgrade mysql | Feb 27, 2025 | Dec 11, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.5Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.4.3 | Jul 30, 2026 | Dec 11, 2024 |
| Suse | — | Upgrade libcurl4-32bitUpgrade libcurl-devel-32bitUpgrade libcurl-develUpgrade curl-zsh-completionUpgrade curlUpgrade libcurl-mini4Upgrade libcurl4Upgrade libcurl-devel-doc | Dec 31, 2024 | Dec 11, 2024 |
| Ubuntu | — | Upgrade libcurl4-openssl-devUpgrade libcurl4-gnutls-dev (Ubuntu Pro)Upgrade libcurl4 (Ubuntu Pro)Upgrade curlUpgrade libcurl4Upgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl3-nssUpgrade libcurl4-nss-dev (Ubuntu Pro)Upgrade libcurl3-gnutls (Ubuntu Pro)Upgrade libcurl4-openssl-dev (Ubuntu Pro)Upgrade curl (Ubuntu Pro)Upgrade libcurl3-gnutlsUpgrade libcurl4t64Upgrade libcurl3 (Ubuntu Pro)Upgrade libcurl3t64-gnutlsUpgrade libcurl4-gnutls-dev | Dec 17, 2024 | Dec 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Dec 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub