Executive brief
A vulnerability in the curl data transfer tool could cause it to accidentally send the wrong password when connecting to a website. If a user provides a specific username in a web address but does not provide a password, curl may mistakenly pull a password belonging to a different user from the system's credential file (.netrc). This could lead to unauthorized access attempts or the unintended disclosure of sensitive login information to a server.
Technical details
A credential handling flaw exists in curl and libcurl (versions 8.11.1 through 8.20.0) when using .netrc files for authentication. If a URL includes a username but no password (e.g., https://user@example.com/) and the .netrc file does not contain a match for that specific user, curl may incorrectly select and transmit the password of a different user defined for the same host in the .netrc file. This is classified as CWE-522 (Insufficiently Protected Credentials). The issue was introduced in version 8.11.1 and is resolved in version 8.21.0. Users are advised to upgrade or avoid using .netrc for sensitive authentication data.
Affected products
- curl curl 8.11.1 to 8.20.0
- curl libcurl 8.11.1 to 8.20.0
Timeline
- 2026-05-14: disclosed: Reported to the curl project
- 2026-06-17: other: Contacted distros@openwall
- 2026-06-24: patched: Fixed in curl 8.21.0
- 2026-06-24: advisory: Project curl advisory published
- 2026-07-03: other: NVD published date