VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 11, 2024· Updated Nov 3, 2025

netrc and redirect credential leak

CVE-2024-11053

Description

Curl may leak .netrc passwords during HTTP redirects if the redirect target's netrc entry omits the password.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Curl may leak .netrc passwords during HTTP redirects if the redirect target's netrc entry omits the password.

Vulnerability

When curl is configured to use a .netrc file for credentials and to follow HTTP redirects (e.g., with -L), it can leak the password used for the original host to the followed-to host. This occurs if the netrc file has an entry matching the redirect target hostname but that entry omits only the password or omits both login and password. Affected versions are curl 7.76.0 through 8.11.0 inclusive; versions before 7.76.0 and 8.11.1 and later are not affected [1].

Exploitation

The attacker must control a redirect from a host for which the user has a netrc entry with a password to a host whose netrc entry lacks a password (or both login and password). The user must be using curl with --netrc (or --netrc-file) and follow redirects (e.g., -L). The attacker could be the owner of the redirect target or be in a position to perform a man-in-the-middle attack. No authentication is needed; the user's curl automatically sends the leaked password [1].

Impact

Successful exploitation results in disclosure of the password for the original host to the redirect target host. An attacker obtaining this password could gain unauthorized access to the original host using the victim's credentials. The confidentiality of the password is compromised [1].

Mitigation

Upgrade to curl 8.11.1 or apply the patches referenced in the advisory (commits e9b9bbac22c26cf6731, 9fce2c55d4b0273ac99, and 9bee39bfed2c413b4cc). The fix ensures that when a netrc entry lacks a password for the redirect target, the password from the original request is not reused. If upgrading is not immediately possible, avoid using .netrc together with redirect following, or ensure all redirect targets have complete netrc entries (including password) [1].

References
  1. curl - netrc and redirect credential leak

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

42

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.