CVE-2026-6429 Details
Description
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.
A vulnerability in libcurl allows for the unintentional leakage of passwords from a .netrc file when both HTTP redirects are followed and an HTTP proxy connection is reused. This issue affects libcurl versions 7.14.0 prior to 8.20.0. The vulnerability arises because the same connection can be used to send .netrc-derived credentials to multiple hosts, potentially exposing sensitive information to unauthorized parties.
Users can upgrade to libcurl version 8.20.0 or apply the available patch before rebuilding libcurl.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://curl.se/docs/CVE-2026-6429.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-6429.json | curl | Product |
| https://hackerone.com/reports/3677759 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.14.0, < 8.20.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | curl |