CVE-2026-6429: netrc credential leak with reused proxy connection
netrc credential leak with reused proxy connection
Other sources
When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.30.3-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6429?
CVE-2026-6429 has been classified as a moderate severity vulnerability.
How do I fix CVE-2026-6429?
To mitigate CVE-2026-6429, avoid using .netrc files with HTTP redirects and update to a patched version of libcurl.
What causes CVE-2026-6429?
CVE-2026-6429 is caused by the improper handling of credentials when following HTTP redirects while using a .netrc file.
Which versions of libcurl are affected by CVE-2026-6429?
Versions of libcurl prior to the fix release for CVE-2026-6429 are affected.
Can CVE-2026-6429 lead to credential exposure?
Yes, CVE-2026-6429 can lead to the exposure of credentials from the .netrc file when connecting to redirected hosts.