Low severity3.4NVD Advisory· Published Dec 11, 2024· Updated Jun 17, 2026
CVE-2024-11053
CVE-2024-11053
Description
When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
42- osv-coords40 versionspkg:apk/chainguard/curlpkg:apk/chainguard/curl-devpkg:apk/chainguard/curl-docpkg:apk/chainguard/curl-oci-entrypointpkg:apk/chainguard/curl-staticpkg:apk/chainguard/libcurl4pkg:apk/chainguard/libcurl-openssl4pkg:apk/wolfi/curlpkg:apk/wolfi/curl-devpkg:apk/wolfi/curl-docpkg:apk/wolfi/curl-oci-entrypointpkg:apk/wolfi/curl-staticpkg:apk/wolfi/libcurl4pkg:apk/wolfi/libcurl-openssl4pkg:rpm/almalinux/mecabpkg:rpm/almalinux/mecab-develpkg:rpm/almalinux/mecab-ipadicpkg:rpm/almalinux/mecab-ipadic-EUCJPpkg:rpm/almalinux/mysqlpkg:rpm/almalinux/mysql-commonpkg:rpm/almalinux/mysql-develpkg:rpm/almalinux/mysql-errmsgpkg:rpm/almalinux/mysql-libspkg:rpm/almalinux/mysql-serverpkg:rpm/almalinux/mysql-testpkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%20Micro%205.5pkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweedpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Installer%20Updates%2015%20SP5pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/curl&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/curl&distro=SUSE%20Linux%20Micro%206.1
< 8.11.1-r0+ 39 more
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 8.11.1-r0
- (no CPE)range: < 0.996-2.module_el8.10.0+3965+b415b607
- (no CPE)range: < 0.996-2.module_el8.10.0+3965+b415b607
- (no CPE)range: < 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
- (no CPE)range: < 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
- (no CPE)range: < 8.0.41-2.el9_5
- (no CPE)range: < 8.0.41-2.el9_5
- (no CPE)range: < 8.0.41-2.el9_5
- (no CPE)range: < 8.0.41-2.el9_5
- (no CPE)range: < 8.0.41-2.el9_5
- (no CPE)range: < 8.0.41-2.el9_5
- (no CPE)range: < 8.0.41-2.el9_5
- (no CPE)range: < 8.0.1-150400.5.59.1
- (no CPE)range: < 8.6.0-150600.4.15.1
- (no CPE)range: < 8.0.1-150400.5.59.1
- (no CPE)range: < 8.11.1-1.1
- (no CPE)range: < 8.0.1-150400.5.59.1
- (no CPE)range: < 7.66.0-150200.4.81.1
- (no CPE)range: < 7.66.0-150200.4.81.1
- (no CPE)range: < 8.0.1-150400.5.59.1
- (no CPE)range: < 8.0.1-150400.5.59.1
- (no CPE)range: < 8.0.1-150400.5.59.1
- (no CPE)range: < 8.0.1-150400.5.59.1
- (no CPE)range: < 8.6.0-150600.4.15.1
- (no CPE)range: < 8.0.1-11.101.1
- (no CPE)range: < 8.6.0-5.1
- (no CPE)range: < 8.12.1-slfo.1.1_1.1
Patches
Vulnerability mechanics
References
7- hackerone.com/reports/2829063nvdExploitIssue TrackingThird Party Advisory
- www.openwall.com/lists/oss-security/2024/12/11/1nvdMailing ListThird Party Advisory
- curl.se/docs/CVE-2024-11053.htmlnvdVendor Advisory
- curl.se/docs/CVE-2024-11053.jsonnvdVendor Advisory
- security.netapp.com/advisory/ntap-20250124-0012/nvdThird Party Advisory
- security.netapp.com/advisory/ntap-20250131-0003/nvdThird Party Advisory
- security.netapp.com/advisory/ntap-20250131-0004/nvd
News mentions
0No linked articles in our index yet.