CVE-2026-94266None▾ Sunlitlibcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
libcurl could accidentally return a URL for curl_easy_getinfo()'s
CURLINFO_EFFECTIVE_URL option containing credentials, even though neither
the URL provided to libcurl nor the redirected URL did.
curl >= 8.22.0 <= 8.22.0curl >= 8.21.0 <= 8.21.0curl >= 8.20.0 <= 8.20.0curl >= 8.19.0 <= 8.19.0curl >= 8.18.0 <= 8.18.0curl >= 8.17.0 <= 8.17.0curl >= 8.16.0 <= 8.16.0curl >= 8.15.0 <= 8.15.0curl >= 8.14.1 <= 8.14.1curl >= 8.14.0 <= 8.14.0curl >= 8.13.0 <= 8.13.0curl >= 8.12.1 <= 8.12.1curl >= 8.12.0 <= 8.12.0curl >= 8.11.1 <= 8.11.1curl >= 8.11.0 <= 8.11.0curl >= 8.10.1 <= 8.10.1curl >= 8.10.0 <= 8.10.0curl >= 8.9.1 <= 8.9.1curl >= 8.9.0 <= 8.9.0curl >= 8.8.0 <= 8.8.0curl >= 8.7.1 <= 8.7.1curl >= 8.7.0 <= 8.7.0curl >= 8.6.0 <= 8.6.0curl >= 8.5.0 <= 8.5.0curl >= 8.4.0 <= 8.4.0curl >= 8.3.0 <= 8.3.0curl >= 8.2.1 <= 8.2.1curl >= 8.2.0 <= 8.2.0curl >= 8.1.2 <= 8.1.2curl >= 8.1.1 <= 8.1.1curl >= 8.1.0 <= 8.1.0curl >= 8.0.1 <= 8.0.1curl >= 8.0.0 <= 8.0.0curl >= 7.88.1 <= 7.88.1curl >= 7.88.0 <= 7.88.0curl >= 7.87.0 <= 7.87.0curl >= 7.86.0 <= 7.86.0curl >= 7.85.0 <= 7.85.0curl >= 7.84.0 <= 7.84.0curl >= 7.83.1 <= 7.83.1curl >= 7.83.0 <= 7.83.0curl >= 7.82.0 <= 7.82.0curl >= 7.81.0 <= 7.81.0curl >= 7.80.0 <= 7.80.0curl >= 7.79.1 <= 7.79.1curl >= 7.79.0 <= 7.79.0curl >= 7.78.0 <= 7.78.0curl >= 7.77.0 <= 7.77.0curl >= 7.76.1 <= 7.76.1curl >= 7.76.0 <= 7.76.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-22923Medium· 5.3When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl wil…
CVE-2022-27776Medium· 6.5A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
CVE-2022-27774Medium· 5.7An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak cr…
CVE-2026-6253Medium· 5.9curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1
CVE-2026-3783Medium· 5.3When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is re…
CVE-2025-14524Medium· 5.3When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target…