performs a redirect to a second URL, curl could leak that token to the second
hostname under some circumstances.
If the hostname that the first request is redirected to has information in the
used .netrc file, with either of the `machine` or `default` keywords, curl
would pass on the bearer token set for the first host also to the second one.
| Source | ID | Title |
|---|---|---|
Ubuntu USN |
USN-8084-1 | curl vulnerabilities |
Ubuntu USN |
USN-8099-1 | curl vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Fri, 13 Mar 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-201 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Thu, 12 Mar 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Haxx
Haxx curl |
|
| CPEs | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Haxx
Haxx curl |
Thu, 12 Mar 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Curl
Curl curl |
|
| Vendors & Products |
Curl
Curl curl |
Wed, 11 Mar 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-522 | |
| Metrics |
cvssV3_1
|
Wed, 11 Mar 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 11 Mar 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one. | |
| Title | token leak with redirect and netrc | |
| References |
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: curl
Published:
Updated: 2026-03-11T14:26:10.788Z
Reserved: 2026-03-08T05:09:09.891Z
Link: CVE-2026-3783
Updated: 2026-03-11T10:16:31.282Z
Status : Analyzed
Published: 2026-03-11T11:16:00.080
Modified: 2026-03-12T14:10:37.300
Link: CVE-2026-3783
OpenCVE Enrichment
Updated: 2026-03-12T10:06:04Z
Ubuntu USN