https://seclists.org/oss-sec/2026/q1/292: [ADVISORY] curl: CVE-2026-3783: token leak with dict and netrc
Published Mar 11, 2026
·Updated
Affected Software
1 affected component
redhat/libcurl>=7.33.0<=8.18.0
Frequently Asked Questions
1
What is the severity of CVE-2026-3783?
CVE-2026-3783 is rated as a medium severity vulnerability.
2
How do I fix CVE-2026-3783?
To mitigate CVE-2026-3783, avoid using OAuth2 bearer tokens with redirects when using curl.
3
Which versions of curl are affected by CVE-2026-3783?
CVE-2026-3783 affects specific versions of curl that utilize OAuth2 bearer tokens during HTTP(S) transfers.
4
What type of attack does CVE-2026-3783 enable?
CVE-2026-3783 may enable unauthorized access to sensitive OAuth2 tokens through insecure redirection.
5
Is there a workaround for CVE-2026-3783?
Yes, a temporary workaround for CVE-2026-3783 includes disabling automated redirection when using tokens.