Curl 7.62.0 < 8.23.0 Effective URL Password Leak

The version of curl installed on the remote host is 7.62.0 prior to 8.23.0. It is, therefore, affected by an information disclosure vulnerability: - libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provid...

AZL-110034 CVE-2026-94266 affecting package mysql 8.0.46-2

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

AZL-110157 CVE-2026-94266 affecting package rust 1.75.0-31

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

AZL-110220 CVE-2026-94266 affecting package rust 1.96.1-2

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

DEBIAN-CVE-2026-94266

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

AZL-109947 CVE-2026-94266 affecting package curl 8.11.1-12

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

AZL-109908 CVE-2026-94266 affecting package cmake 3.30.3-15

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

AZL-110292 CVE-2026-94266 affecting package tensorflow 2.16.1-11

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

ALPINE-CVE-2026-94266

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

CVE-2026-94266

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

CVE-2026-94266

libcurl could accidentally return a URL for "curleasygetinfo"'s "CURLINFOEFFECTIVEURL" option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

EUVD-2026-105355

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

CVE-2026-94266

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

CVE-2026-94266

The libcurl library is vulnerable to an information disclosure flaw where the curl_easy_getinfo() function's CURLINFO_EFFECTIVE_URL option may accidentally return a URL containing credentials . This occurs even when neither the original URL provided to libcurl nor the redirected URL contains such...

CVE-2026-94266 password leak in CURLINFO_EFFECTIVE_URL

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

CVE-2026-94266

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

CVE-2026-94266 password leak in CURLINFO_EFFECTIVE_URL

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

Red Hat: CVE-2026-94266: curl: curl: password leak in CURLINFO_EFFECTIVE_URL

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

SUSE CVE-2026-94266

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the CURLINFOEFFECTIVEURL process. An attacker can access sensitive authentication credentials by querying the effective URL metadata after credentials are sourced from a local configuration file...