CVE-2026-6429

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

Scoring

Severity

MEDIUM

CVSS base score

5.3

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS probability

0.52%

CWE

CWE-200

Published

2026-05-13

Last modified

2026-09-17

Affected products

• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl

Weakness type

• CWE-200

Related vulnerabilities

• CVE-2026-92960 — vm2 before 3.11.6 Process-wide State Exposure via os and dns
• CVE-2026-92947 — vm2 before 3.11.7 Memory Disclosure via Buffer Pool
• CVE-2026-87820 — CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
• CVE-2026-86464 — In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity
• CVE-2026-87541 — Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the
• CVE-2026-78960 — Information leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engin
• CVE-2026-87593 — Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive inform
• CVE-2026-87565 — Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak se

Markdown version · Browse all CVEs