Sensitive Data Exposure in libcurl Affects Multiple Versions
CVE-2026-94266
Currently unrated
What is CVE-2026-94266?
libcurl, a widely used client-side URL transfer library, has a vulnerability that could inadvertently expose sensitive credentials. When using the curl_easy_getinfo() function, the CURLINFO_EFFECTIVE_URL option may return an erroneous URL that contains credentials, despite the original and redirected URLs not including any. This flaw poses a risk to applications relying on libcurl for secure data transmission, emphasizing the need for careful handling of returned data to safeguard user credentials.
Affected Version(s)
curl 8.22.0
curl 8.21.0
curl 8.20.0