When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mysql-testUpgrade mysqlUpgrade mecab-develUpgrade mysql-serverUpgrade mecabUpgrade mysql-develUpgrade mysql-errmsgUpgrade mecab-ipadicUpgrade mysql-commonUpgrade mysql-libsUpgrade mecab-ipadic-EUCJP | Feb 21, 2025 | Dec 11, 2024 |
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Dec 11, 2024 |
| Amazon_linux_2023 | — | Upgrade libcurlUpgrade curl-debuginfoUpgrade libcurl-develUpgrade curl-minimalUpgrade libcurl-debuginfoUpgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade curlUpgrade curl-minimal-debuginfoUpgrade curl-debugsource | Jan 12, 2026 | Dec 11, 2024 |
| Debian | — | Upgrade curl | Mar 17, 2025 | Dec 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libcurlUpgrade curl | Apr 11, 2025 | Dec 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade curlUpgrade libcurl | Mar 19, 2025 | Dec 11, 2024 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory7 | Nov 6, 2025 | Jun 4, 2025 |
| Oracle Httpserver | — | Apply patch 37658370 to Oracle HTTP Server 14.1.2.0.0.Apply patch 37677581 to Oracle HTTP Server 12.2.1.4.0. | Sep 30, 2026 | Dec 11, 2024 |
| Oracle Mysql | — | Upgrade to MySQL version 8.0.41Upgrade to MySQL version 9.2.0Upgrade to MySQL version 8.4.4 | Jan 22, 2025 | Dec 11, 2024 |
| Oracle_linux | — | Upgrade mecab-ipadic-EUCJPUpgrade mysql-libsUpgrade mysql-serverUpgrade mysql-develUpgrade mysql-commonUpgrade mecabUpgrade mecab-develUpgrade mysql-errmsgUpgrade mysqlUpgrade mecab-ipadicUpgrade mysql-test | Feb 25, 2025 | Dec 11, 2024 |
| Redhat_linux | — | Upgrade mysql-testNo solution existsUpgrade mysql-libs-debuginfoUpgrade mysqlUpgrade mysql-errmsgUpgrade mecabUpgrade mecab-debuginfoUpgrade mysql-commonUpgrade mysql-debuginfoUpgrade mysql-test-debuginfoUpgrade mecab-debugsourceUpgrade mecab-ipadic-EUCJPUpgrade mecab-develUpgrade mysql-libsUpgrade mysql-develUpgrade mysql-serverUpgrade mysql-server-debuginfoUpgrade mysql-debugsourceUpgrade mysql-devel-debuginfoUpgrade mecab-ipadic | Feb 20, 2025 | Dec 11, 2024 |
| Rocky_linux | — | Upgrade mysql-test-debuginfoUpgrade mysql-libsUpgrade mecab-debuginfoUpgrade mecab-ipadicUpgrade mysql-server-debuginfoUpgrade mecab-ipadic-EUCJPUpgrade mysql-commonUpgrade mysql-debuginfoUpgrade mysql-libs-debuginfoUpgrade mecab-develUpgrade mysql-develUpgrade mysql-testUpgrade mecabUpgrade mysql-devel-debuginfoUpgrade mecab-debugsourceUpgrade mysql-errmsgUpgrade mysql-debugsourceUpgrade mysqlUpgrade mysql-server | Feb 27, 2025 | Dec 11, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.3Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.3.5 | Jul 30, 2026 | Dec 11, 2024 |
| Suse | — | Upgrade libcurl-develUpgrade curl-zsh-completionUpgrade libcurl-mini4Upgrade curlUpgrade libcurl4-32bitUpgrade libcurl-devel-32bitUpgrade libcurl-devel-docUpgrade libcurl4 | Dec 31, 2024 | Dec 11, 2024 |
| Ubuntu | — | Upgrade libcurl4-gnutls-dev (Ubuntu Pro)Upgrade libcurl4Upgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl4 (Ubuntu Pro)Upgrade curlUpgrade libcurl4-nss-dev (Ubuntu Pro)Upgrade libcurl3-nssUpgrade libcurl4-openssl-devUpgrade libcurl4t64Upgrade libcurl3-gnutls (Ubuntu Pro)Upgrade libcurl3 (Ubuntu Pro)Upgrade libcurl4-gnutls-devUpgrade libcurl3t64-gnutlsUpgrade libcurl4-openssl-dev (Ubuntu Pro)Upgrade curl (Ubuntu Pro)Upgrade libcurl3-gnutls | Dec 17, 2024 | Dec 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Dec 11, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub