VULNERABILITY INTELLIGENCE

CVE-2024-11053

CVSS score3.4 LOW
EPSS probability1.97%
CISA KEVNot currently listed
Published2024-12-11
Last modified2026-10-15
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Description

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

Weakness classification

  • nvd@nist.gov: NVD-CWE-noinfo

Primary references