When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
CVSS Details
- CVSS 3.1 Base Score: 3.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mysql-errmsgUpgrade mecab-ipadic-EUCJPUpgrade mecab-ipadicUpgrade mysql-commonUpgrade mysql-libsUpgrade mysql-testUpgrade mysqlUpgrade mysql-develUpgrade mysql-serverUpgrade mecab-develUpgrade mecab | Feb 21, 2025 | Dec 11, 2024 |
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Dec 11, 2024 |
| Amazon_linux_2023 | — | Upgrade libcurlUpgrade libcurl-debuginfoUpgrade curl-minimalUpgrade curl-debuginfoUpgrade libcurl-develUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimalUpgrade curlUpgrade curl-minimal-debuginfoUpgrade curl-debugsource | Jan 12, 2026 | Dec 11, 2024 |
| Debian | — | Upgrade curl | Mar 17, 2025 | Dec 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Apr 11, 2025 | Dec 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | Mar 19, 2025 | Dec 11, 2024 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory7 | Nov 6, 2025 | Jun 4, 2025 |
| Oracle Httpserver | — | Apply patch 37658370 to Oracle HTTP Server 14.1.2.0.0.Apply patch 37677581 to Oracle HTTP Server 12.2.1.4.0. | Sep 30, 2026 | Dec 11, 2024 |
| Oracle Mysql | — | Upgrade to MySQL version 8.4.4Upgrade to MySQL version 8.0.41Upgrade to MySQL version 9.2.0 | Jan 22, 2025 | Dec 11, 2024 |
| Oracle_linux | — | Upgrade mysql-commonUpgrade mecab-ipadic-EUCJPUpgrade mysql-serverUpgrade mysql-develUpgrade mysql-libsUpgrade mysql-testUpgrade mysql-errmsgUpgrade mecab-ipadicUpgrade mecabUpgrade mysqlUpgrade mecab-devel | Feb 25, 2025 | Dec 11, 2024 |
| Redhat_linux | — | Upgrade mysql-errmsgUpgrade mecabUpgrade mysql-commonNo solution existsUpgrade mysql-testUpgrade mysql-test-debuginfoUpgrade mysql-libs-debuginfoUpgrade mecab-debuginfoUpgrade mysqlUpgrade mysql-debuginfoUpgrade mecab-develUpgrade mecab-debugsourceUpgrade mecab-ipadic-EUCJPUpgrade mecab-ipadicUpgrade mysql-develUpgrade mysql-libsUpgrade mysql-serverUpgrade mysql-server-debuginfoUpgrade mysql-devel-debuginfoUpgrade mysql-debugsource | Feb 20, 2025 | Dec 11, 2024 |
| Rocky_linux | — | Upgrade mysql-libs-debuginfoUpgrade mysql-serverUpgrade mecab-debugsourceUpgrade mysql-develUpgrade mecabUpgrade mecab-develUpgrade mysql-devel-debuginfoUpgrade mysql-testUpgrade mysql-errmsgUpgrade mysql-debugsourceUpgrade mysqlUpgrade mysql-commonUpgrade mecab-ipadic-EUCJPUpgrade mysql-test-debuginfoUpgrade mecab-debuginfoUpgrade mecab-ipadicUpgrade mysql-libsUpgrade mysql-server-debuginfoUpgrade mysql-debuginfo | Feb 27, 2025 | Dec 11, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.5Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.4.3 | Jul 30, 2026 | Dec 11, 2024 |
| Suse | — | Upgrade libcurl-devel-docUpgrade libcurl4Upgrade curl-zsh-completionUpgrade libcurl4-32bitUpgrade libcurl-mini4Upgrade libcurl-devel-32bitUpgrade libcurl-develUpgrade curl | Dec 31, 2024 | Dec 11, 2024 |
| Ubuntu | — | Upgrade libcurl4t64Upgrade curl (Ubuntu Pro)Upgrade libcurl3 (Ubuntu Pro)Upgrade libcurl4-openssl-dev (Ubuntu Pro)Upgrade libcurl3-gnutlsUpgrade libcurl3-gnutls (Ubuntu Pro)Upgrade libcurl4-gnutls-devUpgrade libcurl3t64-gnutlsUpgrade libcurl3-nssUpgrade libcurl4-nss-dev (Ubuntu Pro)Upgrade libcurl4 (Ubuntu Pro)Upgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl4-gnutls-dev (Ubuntu Pro)Upgrade libcurl4-openssl-devUpgrade libcurl4Upgrade curl | Dec 17, 2024 | Dec 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Dec 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub