HTTP Redirect Vulnerability in Curl by Curl Development Group

CVE-2026-94265

What is CVE-2026-94265?

Curl has a vulnerability where it mishandles HTTP redirects containing userinfo, leading to the potential leakage of Kerberos tickets to malicious servers. When curl processes a URL with userinfo, it may inadvertently send the authentication state of the original host, allowing attackers to exploit this behavior. This can result in unauthorized access to sensitive information if a user is redirected to an untrusted third-party host without proper domain scoping controls.

References