Libcurl HTTP Password Leak Vulnerability in Curl Software

CVE-2026-6429

What is CVE-2026-6429?

A vulnerability in libcurl occurs when it is instructed to use a .netrc file for storing credentials while simultaneously following HTTP redirects. Under specific conditions, this flaw can lead to the unintended leakage of the user's password from the first host to the subsequent host that is redirected to, potentially compromising sensitive information. It is essential for users of this software to be aware of these implications and to apply necessary mitigations.

References