Skip to content
fr Sign in
9.1 Critical

CVE-2026-94265 When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might…

Description

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`.

Affected products and versions

Product Affected versions Fixed in
curl 8.22.0 No fix stated
curl 8.21.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of curl

The 98 CVEs of curl →
CVE-2026-107929 When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes… 8.1 High CVE-2026-107928 When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer 8.1 High CVE-2026-94266 libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing… 7.5 High CVE-2026-92391 A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal… 7.5 High
Track this CVE