An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 5.7 · haxx, debian, netappNVD modified 2026-10-14 17:17
Affected (CPE criteria) 14
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
References 12
- https://hackerone.com/reports/1543773 Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220609-0008/ Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197 Third Party Advisory
- https://hackerone.com/reports/1543773 Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220609-0008/ Third Party Advisory
- https://www.debian.org/security/2022/dsa-5197 Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://hackerone.com/reports/1543773 Exploit, Third Party Advisory