CVE-2026-6429 - Vulnerability Analysis

Overview

libcurl contains an information disclosure vulnerability caused by leaking .netrc credentials during HTTP redirects, letting attackers on redirected hosts access leaked passwords, exploit requires HTTP redirects with .netrc usage.

Severity & Score

Impact

Attackers on redirected hosts can obtain leaked passwords from .netrc files, compromising user credentials.

Mitigation

Update to the latest version of libcurl.

References

• https://curl.se/docs/CVE-2026-6429.html
• https://curl.se/docs/CVE-2026-6429.json
• https://hackerone.com/reports/3677759

Social Media Activity(1 post)

daniel:// stenberg://

@bagder

Apr 29, 2026

Out of the eight new #curl CVEs, four of them had existed in code for over twenty years when we published. CVE-2026-5545 clocks in at 22.75 years old CVE-2026-7168 at 21.91 years CVE-2026-6429 at 20.95 years CVE-2026-6253 at 20.66 years And yet CVE-2026-5545 only becomes the 5th oldest vulnerability ever found in curl so far.

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner