[<prev] [next>] [day] [month] [year] [list]
Message-ID: <685315s4-3r44-sn64-5qsq-q62100341506@unkk.fr>
Date: Wed, 29 Apr 2026 08:01:19 +0200 (CEST)
From: Daniel Stenberg <daniel@...x.se>
To: curl security announcements -- curl users <curl-users@...ts.haxx.se>,
curl-announce@...ts.haxx.se, libcurl hacking <curl-library@...ts.haxx.se>,
oss-security@...ts.openwall.com
Subject: [ADVISORY] curl: CVE-2026-6429: netrc credential leak with reused
proxy connection
netrc credential leak with reused proxy connection
==================================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-6429.html)
VULNERABILITY
-------------
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, libcurl could leak the password used for the first host to the
followed-to host under certain circumstances.
INFO
----
To trigger, this flaw requires that both the original URL and the redirect URL
are using clear text `http://` URLs, that both are performed over the same
HTTP proxy and that the same connection is reused.
Similar to [CVE-2024-11053](https://curl.se/docs/CVE-2024-11053.html)
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-6429 to this issue.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Severity: Medium
AFFECTED VERSIONS
-----------------
- Affected versions: from curl 7.14.0 to and including 8.19.0
- Not affected versions: curl < 7.14.0 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/01165e08e0d131b399fb
libcurl is used by many applications, but not always advertised as such!
This bug is not considered a *C mistake*. It is not likely to have been
avoided had we not been using C.
This flaw does **not** affect the curl command line tool.
SOLUTION
--------
- Fixed-in: https://github.com/curl/curl/commit/b4024bf808bd558026fdc6
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade to curl and libcurl 8.20.0
B - Apply the patch and rebuild libcurl
C - Avoid using the combination netrc, HTTP and HTTP proxy
TIMELINE
---------
It was reported to the curl project on April 16th 2026. We contacted
distros@...nwall on April 23.
libcurl 8.20.0 was released on April 29th 2026, coordinated with the
publication of this advisory.
CREDITS
-------
- Reported-by: Muhamad Arga Reksapati
- Patched-by: Daniel Stenberg
Thanks a lot!
--
/ daniel.haxx.se || https://rock-solid.curl.dev
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
