Credential Leakage in Curl Affects Password Management

CVE-2025-0167

What is CVE-2025-0167?

Curl has a vulnerability that can result in the unintended leakage of login credentials when using a .netrc file combined with HTTP redirects. The issue arises when the .netrc file contains a default entry that lacks defined login and password details. This specific condition can lead to sensitive information being exposed to unintended hosts during the redirect process. It is important for users to review their netrc configurations and be cautious with HTTP operations that involve redirection to mitigate potential risks.

References