When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.
Medium CVSS 5.3
Summary
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://curl.se/docs/CVE-2026-6429.html Patch
- https://curl.se/docs/CVE-2026-6429.json Product
- https://hackerone.com/reports/3677759 Exploit
Timeline
- nvd_ingest NVD