Is CVE-2026-6429 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6429 being exploited in the wild.

How severe is CVE-2026-6429?

Medium severity, with a CVSS score of 5.3, published 13 May 2026.

Is there a fix for CVE-2026-6429?

A patch was published on 2026-04-29: libcurl 8.20.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6429 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6429?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6429: When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password…

CVE-2026-6429 · Severity: medium · CVSS 5.3 · Published 2026-05-13

A security flaw in the libcurl library, which is used by many applications to transfer data over the internet, could allow sensitive login credentials to be leaked. If an application is configured to use a .netrc file for passwords and follows a web redirect through a proxy, it may accidentally send the password for the first website to the second website. This could allow a malicious server to capture user credentials.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-6429 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6429 being exploited in the wild.
How severe is CVE-2026-6429?: Medium severity, with a CVSS score of 5.3, published 13 May 2026.
Which products and versions are affected?: curl libcurl 7.14.0 to 8.19.0.
Is there a fix for CVE-2026-6429?: A patch was published on 2026-04-29: libcurl 8.20.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6429 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6429?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A credential leak exists in libcurl (CWE-200) when it is configured to use a .netrc file for authentication and follow HTTP redirects. The vulnerability is triggered when both the original and redirect URLs use unencrypted HTTP, are accessed via the same HTTP proxy, and reuse the same connection. Under these conditions, libcurl may fail to clear the password used for the initial host before sending the request to the redirected host. This issue does not affect the curl command-line tool. A fix is available in version 8.20.0.

Affected products

curl libcurl 7.14.0 to 8.19.0

Timeline

2026-04-16: other: Reported to the curl project
2026-04-29: patched: libcurl 8.20.0 released
2026-04-29: advisory: Project curl security advisory published
2026-05-13: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.