Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
libcurl may expose saved password to redirected sites
published 6 months ago
Summary
If your software uses libcurl to read login details from a .netrc file and also follows web redirects, the password for the first website could be sent to the second website by mistake. This could let an unintended site see sensitive credentials. Update libcurl to a version that fixes this behavior or disable automatic redirects when using .netrc files.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | curl | All versions |
Original advisory text
ECHO-2ec8-1a62-f90d
Timeline
Published30 Apr 2026
Updated30 Apr 2026
First seen30 Apr 2026
Sources
ECHO-2ec8-1a62-f90d · OSV
Track software like this
Free during beta