When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.
CVSS Details
- CVSS 3.1 Base Score: 3.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Aug 8, 2025 | Feb 5, 2025 |
| Debian | — | Upgrade curl | Mar 17, 2025 | Feb 5, 2025 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Apr 11, 2025 | Feb 5, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | May 7, 2025 | Feb 5, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libcurlUpgrade curl | Apr 1, 2025 | Feb 5, 2025 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory7 | Nov 6, 2025 | Jun 4, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.6Upgrade Splunk Enterprise to version 9.4.5Upgrade Splunk Enterprise to version 9.2.8Upgrade Splunk Enterprise to version 9.4.3Upgrade Splunk Enterprise to version 9.3.5Upgrade Splunk Enterprise to version 10.0.1Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.3.7Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.2.9Upgrade Splunk Enterprise to version 9.4.4 | Jul 30, 2026 | Feb 5, 2025 |
| Suse | — | Upgrade curlUpgrade libcurl4-32bitUpgrade libcurl-develUpgrade libcurl4Upgrade libcurl-devel-32bit | Feb 10, 2025 | Feb 5, 2025 |
| Ubuntu | — | Upgrade libcurl3-nssUpgrade libcurl4t64Upgrade curlUpgrade libcurl3t64-gnutlsUpgrade libcurl3-gnutlsUpgrade libcurl4 | Jun 26, 2025 | Feb 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Feb 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub