CVE-2025-0167Low· 3.4▾ TwilightPoC availableWhen asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc f…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 18.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
Exploit / PoC code exists
0.7% → 0.7%
When asked to use a .netrc file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has a default entry that
omits both login and password. A rare circumstance.
curl >= 7.76.0, < 8.12.0h700s_firmwareh615c_firmwareh610s_firmwareh610c_firmwareh500s_firmwareh410s_firmwareh410c_firmwareh300s_firmwarebootstrap_oselement_softwareontap = 9ontap_select_deploy_administration_utilityontap_tools = 9solidfire_&_hci_management_nodesolidfire_&_hci_storage_nodeUpgrade past the affected range:
curl 8.12.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-11053Low· 3.4When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc …
CVE-2022-32221Critical· 9.8When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PU…
CVE-2021-22925Medium· 5.3curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl
CVE-2021-22898Low· 3.1curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers
CVE-2020-8284Low· 3.7A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and n…
CVE-2022-27775High· 7.5An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.