When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances.
If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade curl-minimalUpgrade libcurl-minimalUpgrade libcurl-develUpgrade libcurlUpgrade curl | Oct 11, 2026 | Aug 17, 2026 |
| Alpine Linux | — | Upgrade curl | May 20, 2026 | Mar 11, 2026 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Sep 10, 2026 | Jul 27, 2026 |
| Debian | — | Upgrade curl | Jul 12, 2026 | Jul 12, 2026 |
| Freebsd | — | Upgrade curl | Mar 12, 2026 | Mar 11, 2026 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory10 | Jun 28, 2026 | Jun 26, 2026 |
| Redhat_linux | — | Upgrade libcurl-develUpgrade libcurl-debuginfoUpgrade libcurlUpgrade curl-debugsourceNo solution existsUpgrade curl-minimalUpgrade curlUpgrade curl-minimal-debuginfoUpgrade libcurl-minimalUpgrade curl-debuginfoUpgrade libcurl-minimal-debuginfo | Jul 17, 2026 | Mar 11, 2026 |
| Rocky_linux | — | Upgrade libcurl-minimal-debuginfoUpgrade libcurl-develUpgrade libcurl-debuginfoUpgrade libcurl-minimalUpgrade curl-minimalUpgrade curlUpgrade libcurlUpgrade curl-debuginfoUpgrade curl-minimal-debuginfoUpgrade curl-debugsource | Aug 20, 2026 | Aug 17, 2026 |
| Suse | — | Upgrade libcurl-devel-32bitUpgrade libcurl-devel-docUpgrade libcurl-mini4Upgrade curl-fish-completionUpgrade libcurl4Upgrade curl-zsh-completionUpgrade libcurl-develUpgrade libcurl4-32bitUpgrade curl | Mar 13, 2026 | Mar 12, 2026 |
| Ubuntu | — | Upgrade libcurl4 (Ubuntu Pro)Upgrade libcurl3-nssUpgrade libcurl4t64Upgrade libcurl4Upgrade curlUpgrade libcurl3t64-gnutlsUpgrade libcurl3-gnutlsUpgrade libcurl3-nss (Ubuntu Pro)Upgrade curl (Ubuntu Pro)Upgrade libcurl3-gnutls (Ubuntu Pro) | Mar 12, 2026 | Mar 11, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub