Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
[ADVISORY] curl: CVE-2026-6429: netrc credential leak with reused proxy connection
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Wed, 29 Apr 2026 08:01:19 +0200 (CEST)
netrc credential leak with reused proxy connection
==================================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-6429.html)
VULNERABILITY
-------------
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, libcurl could leak the password used for the first host to the
followed-to host under certain circumstances.
INFO
Date: Wed, 29 Apr 2026 08:01:19 +0200 (CEST)
netrc credential leak with reused proxy connection
==================================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-6429.html)
VULNERABILITY
-------------
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, libcurl could leak the password used for the first host to the
followed-to host under certain circumstances.
INFO
---- To trigger, this flaw requires that both the original URL and the redirect URL are using clear text `http://` URLs, that both are performed over the same HTTP proxy and that the same connection is reused. Similar to [CVE-2024-11053](https://curl.se/docs/CVE-2024-11053.html) The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-6429 to this issue. CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Severity: Medium AFFECTED VERSIONS ----------------- - Affected versions: from curl 7.14.0 to and including 8.19.0 - Not affected versions: curl < 7.14.0 and >= 8.20.0 - Introduced-in: https://github.com/curl/curl/commit/01165e08e0d131b399fb libcurl is used by many applications, but not always advertised as such! This bug is not considered a *C mistake*. It is not likely to have been avoided had we not been using C. This flaw does **not** affect the curl command line tool. SOLUTION -------- - Fixed-in: https://github.com/curl/curl/commit/b4024bf808bd558026fdc6 RECOMMENDATIONS --------------- We suggest you take one of the following actions immediately, in order of preference: A - Upgrade to curl and libcurl 8.20.0 B - Apply the patch and rebuild libcurl C - Avoid using the combination netrc, HTTP and HTTP proxy TIMELINE --------- It was reported to the curl project on April 16th 2026. We contacted distros_at_openwall on April 23. libcurl 8.20.0 was released on April 29th 2026, coordinated with the publication of this advisory. CREDITS ------- - Reported-by: Muhamad Arga Reksapati - Patched-by: Daniel Stenberg Thanks a lot! -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2026-04-29