VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 5, 2021· Updated Nov 19, 2024

CVE-2021-22923

CVE-2021-22923

Description

Curl's metalink feature passes user credentials from the metalink XML download to content servers without user awareness.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Curl's metalink feature passes user credentials from the metalink XML download to content servers without user awareness.

Vulnerability

When curl is instructed to download content using the metalink feature, and a username and password are used to retrieve the metalink XML file, those same credentials are automatically forwarded to every server from which curl attempts to download the actual file contents [1]. Affected versions include curl prior to the fix incorporated in Gentoo's GLSA 202212-01 [2].

Exploitation

An attacker needs to set up a metalink XML file that requires authentication to fetch, and also controls at least one content server that will receive the forwarded credentials [1]. No additional user interaction beyond the initial curl metalink download is required; the credential leakage happens transparently.

Impact

Credentials intended only for the metalink metadata server are exposed to third-party content servers, often against the user's expectations and without any notification [1]. This can lead to disclosure of authentication secrets to unauthorized parties.

Mitigation

Upgrade curl to version 7.86.0 or later as specified in the Gentoo GLSA advisory [2]. No workaround is available [2]. Systems using affected curl versions should apply the update as soon as possible.

References
  1. lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
  2. Multiple Vulnerabilities (GLSA 202212-01) — Gentoo security

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

29

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

6

News mentions

0

No linked articles in our index yet.