Please donate a few minutes of your time to the curl user survey 2024
curl / Docs / curl CVEs / Metalink download sends credentials
Awarded 700 USD


Metalink download sends credentials

Project curl Security Advisory, July 21th 2021 - Permalink


When curl is instructed to get content using the Metalink feature, and a user name and password are used to download the Metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.


This flaw exists only in the curl tool. libcurl is not affected.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2021-22923 to this issue.

CWE-522: Insufficiently Protected Credentials

Severity: Medium



curl has completely removed the Metalink feature as of 7.78.0. No fix for this flaw will be produced by the curl project.

The fix for earlier versions is to rebuild curl with the Metalink support switched off!


A - Upgrade curl to version 7.78.0

B - Make sure you do not use Metalink with curl

C - Disable Metalink in your build


This issue was reported to the curl project on May 30, 2021.

This advisory was posted on Jul 21, 2021.


Thanks a lot!