Pending AnalysisCVE-2026-6429

netrc credential leak with reused proxy connection

Platform

c

Component

curl

Fixed in

8.19.1

When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

Threat Intelligence

Exploit Status

Proof of ConceptUnknown
CISA KEVNO

EPSS

0.02% (4% percentile)

Affected Software

Componentcurl
Vendorcurl
Minimum version8.12.0
Maximum version8.19.0
Fixed in8.19.1

Weakness Classification (CWE)

Timeline

  1. Reserved
  2. Published
  3. EPSS updated

How to fix

Actualice a la versión 8.19.1 o posterior para evitar la fuga de credenciales. Este problema se produce al usar un archivo .netrc y seguir redirecciones HTTP, por lo que es importante aplicar la actualización lo antes posible para proteger la información confidencial.

Is your project affected?

Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.

livefree scan

Try it now — no account

Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.

Manual scanSlack/email alertsContinuous monitoringWhite-label reports

Drag & drop your dependency file

composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...