CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL
Last updated 20 October 2026
Other sources
libcurl could accidentally return a URL for curleasygetinfo()'s CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.23.0-1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.68.0-1ubuntu2.25+esm10 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.81.0-1ubuntu1.30 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.5.0-2ubuntu10.16 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8 - Upgrade
Upgrade
azurelinux/curlto a version that resolves this vulnerability.Fixed in 8.11.1-13
Event History
Frequently Asked Questions
Which applications are most likely to be affected?
Applications that use libcurl and retrieve CURLINFO_EFFECTIVE_URL through curl_easy_getinfo() may receive a URL containing credentials. The listed affected software is debian/curl.
How can I determine whether this behavior is occurring in my application?
Review values returned by CURLINFO_EFFECTIVE_URL and check whether they contain embedded credentials. The issue can occur even when neither the URL supplied to libcurl nor the redirect URL contained credentials.
What version of debian/curl is affected or fixed?
The provided information does not identify affected or fixed version numbers.