---
id: CVE-2024-11053
title: |-
  When asked to both use a `.netrc` file for credentials and to follow HTTP
  redirects, curl could leak the password used for the first host to the
  followed-to host under certain circumstances.

  This flaw only manifests itself if the netrc …
summary: |-
  When asked to both use a `.netrc` file for credentials and to follow HTTP
  redirects, curl could leak the password used for the first host to the
  followed-to host under certain circumstances.

  This flaw only manifests itself if the netrc …
severity: low
cvss: 3.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N'
vendor: haxx
product: curl
affected:
  - 'curl >= 7.76.0, < 8.11.1'
  - ontap = 9
  - ontap_select_deploy_administration_utility
  - h610c_firmware
  - h610s_firmware
  - h615c_firmware
  - h700s_firmware
  - bootstrap_os
  - h300s_firmware
  - h410s_firmware
  - h500s_firmware
patched:
  - curl 8.11.1
published: '2024-12-11'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:17:18.513'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-11053'
references:
  - url: 'https://curl.se/docs/CVE-2024-11053.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2024-11053.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/2829063'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'http://www.openwall.com/lists/oss-security/2024/12/11/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250124-0012/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250131-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250131-0004/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-089022.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-212953.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.01348
epssPercentile: 0.70913
ingestedAt: '2026-10-15T03:30:12.771Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-12-15T16:47:42.738403Z'
cwe:
  - CWE-200
---

## Overview

When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has an entry that matches
the redirect target hostname but the entry either omits just the password or
omits both login and password.

## Affected

- `curl >= 7.76.0, < 8.11.1`
- `ontap = 9`
- `ontap_select_deploy_administration_utility`
- `h610c_firmware`
- `h610s_firmware`
- `h615c_firmware`
- `h700s_firmware`
- `bootstrap_os`
- `h300s_firmware`
- `h410s_firmware`
- `h500s_firmware`

## Remediation

Upgrade past the affected range:

- `curl 8.11.1`