CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL
Last updated 20 October 2026
Other sources
libcurl could accidentally return a URL for curleasygetinfo()'s CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.23.0-1
Event History
Frequently Asked Questions
Which applications are most likely to be affected?
Applications that use libcurl and retrieve CURLINFO_EFFECTIVE_URL through curl_easy_getinfo() may receive a URL containing credentials. The listed affected software is debian/curl.
How can I determine whether this behavior is occurring in my application?
Review values returned by CURLINFO_EFFECTIVE_URL and check whether they contain embedded credentials. The issue can occur even when neither the URL supplied to libcurl nor the redirect URL contained credentials.
What version of debian/curl is affected or fixed?
The provided information does not identify affected or fixed version numbers.