CVE-2026-94265

The curl library (and libcurl package) is vulnerable to an information exposure flaw when processing HTTP redirects to URLs containing userinfo (a username:password component). The software may erroneously retain and re-transmit the original host's HTTP Negotiate authentication state to an untrus...