CVE-2026-6429CWE-200information-disclosure
CVE-2026-6429
Medium · published May 13, 2026
What it is
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, libcurl could leak the password used for the first host to the
followed-to host under certain circumstances.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00519 · 43.3th percentile
- Weakness
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- Published
- 2026-05-13T17:01Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| haxx/curl | ≥ 7.14.0, < 8.20.0 | 8.20.0 |
References (3)
EPSS history
Timeline