CVE-2024-11053
published 2024-12-11CVE-2024-11053: When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to…
PriorityP415low3.4CVSS 3.1
AVNACHPRNUIRSCCLINAN
EPSS
1.38%
69.2th percentile
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches
the redirect target hostname but the entry either omits just the password or
omits both login and password.
Affected
228 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| curl | curl | 6.5 – 6.5 | — |
| curl | curl | 6.5.1 – 6.5.1 | — |
| curl | curl | 6.5.2 – 6.5.2 | — |
| curl | curl | 7.1 – 7.1 | — |
| curl | curl | 7.1.1 – 7.1.1 | — |
| curl | curl | 7.10 – 7.10 | — |
| curl | curl | 7.10.1 – 7.10.1 | — |
| curl | curl | 7.10.2 – 7.10.2 | — |
| curl | curl | 7.10.3 – 7.10.3 | — |
| curl | curl | 7.10.4 – 7.10.4 | — |
| curl | curl | 7.10.5 – 7.10.5 | — |
| curl | curl | 7.10.6 – 7.10.6 | — |
| curl | curl | 7.10.7 – 7.10.7 | — |
| curl | curl | 7.10.8 – 7.10.8 | — |
| curl | curl | 7.11.0 – 7.11.0 | — |
| curl | curl | 7.11.1 – 7.11.1 | — |
| curl | curl | 7.11.2 – 7.11.2 | — |
| curl | curl | 7.12.0 – 7.12.0 | — |
| curl | curl | 7.12.1 – 7.12.1 | — |
| curl | curl | 7.12.2 – 7.12.2 | — |
| curl | curl | 7.12.3 – 7.12.3 | — |
| curl | curl | 7.13.0 – 7.13.0 | — |
| curl | curl | 7.13.1 – 7.13.1 | — |
| curl | curl | 7.13.2 – 7.13.2 | — |
| curl | curl | 7.14.0 – 7.14.0 | — |
CVSS provenance
nvdv3.13.4LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
osv3.4LOW
vendor_oracle9.1LOW
vendor_debian3.4LOW
vendor_msrc3.4LOW
vendor_redhat3.4LOW
vendor_ubuntu3.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
curl vulnerabilities
vendor_ubuntu·2026-07-09·CVSS 3.4
CVE-2026-11352 [LOW] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Harry Sintonen discovered that curl incorrectly handled credentials when
following HTTP redirects in conjunction with .netrc files. An attacker
could possibly use this issue to obtain sensitive information. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2024-11053)
Hiroki Kurosawa discovered that curl incorrectly handled OCSP stapling
responses. A remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu
18.04 LTS. (CVE-2024-8096)
Joshua Rogers discovered that curl had a use-after-free vulnerability when
resetting and cleaning up HTTP/2 stream handles. An attacker could possibly
use this issue
CISA ICS
Siemens COMOS
cisa_ics·2026-02-12·CVSS 3.4
[LOW] Siemens COMOS
ICS Advisory
##
Siemens COMOS
Release DateFebruary 12, 2026
Alert CodeICSA-26-043-03
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
COMOS is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code or cause denial of service condition, data infiltration or perform access control violations. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
The following versions of Siemens COMOS are affected:
- COMOS V10.4 vers:intdot/<10.4.5, vers:intdot/<10.4.5 (CVE-2024-47875, CVE-2025-278
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (curl) — CVE-2024-11053
vendor_oracle·2025-04-15·CVSS 3.4
CVE-2024-11053 [LOW] Oracle Oracle Communications Applications Risk Matrix: Core (curl) — CVE-2024-11053
Oracle Oracle Communications Applications Risk Matrix: Core (curl) vulnerability
CVE: CVE-2024-11053
CVSS: 3.4
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
Oracle
Oracle Oracle MySQL Risk Matrix: Enterprise Backup (curl) — CVE-2024-11053
vendor_oracle·2025-01-15·CVSS 9.1
CVE-2024-11053 [LOW] Oracle Oracle MySQL Risk Matrix: Enterprise Backup (curl) — CVE-2024-11053
Oracle Oracle MySQL Risk Matrix: Enterprise Backup (curl) vulnerability
CVE: CVE-2024-11053
CVSS: 9.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Ubuntu
curl vulnerability
vendor_ubuntu·2024-12-16
CVE-2024-11053 curl vulnerability
Title: curl vulnerability
Summary: curl could be made to expose sensitive information.
Harry Sintonen discovered that curl incorrectly handled credentials from
.netrc files when following HTTP redirects. In certain configurations, the
password for the first host could be leaked to the followed-to host,
contrary to expectations.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
curl: curl netrc password leak
vendor_redhat·2024-12-11·CVSS 3.4
CVE-2024-11053 [LOW] CWE-200 curl: curl netrc password leak
curl: curl netrc password leak
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches
the redirect target hostname but the entry either omits just the password or
omits both login and password.
A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host.
Statement: This issue only affects curl when a `.netrc` file is used and a redirect is performed. Additionally, the
Microsoft
netrc and redirect credential leak
vendor_msrc·2024-12-10·CVSS 3.4
CVE-2024-11053 [LOW] netrc and redirect credential leak
netrc and redirect credential leak
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
curl: curl
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/az
Debian
CVE-2024-11053: curl - When asked to both use a `.netrc` file for credentials and to follow HTTP redire...
vendor_debian·2024·CVSS 3.4
CVE-2024-11053 [LOW] CVE-2024-11053: curl - When asked to both use a `.netrc` file for credentials and to follow HTTP redire...
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
Scope: local
bookworm: resolved (fixed in 7.88.1-10+deb12u10)
bullseye: resolved
forky: resolved (fixed in 8.11.1-1)
sid: resolved (fixed in 8.11.1-1)
trixie: resolved (fixed in 8.11.1-1)
OSV
CVE-2024-11053: When asked to both use a `
osv·2024-12-11·CVSS 3.4
CVE-2024-11053 [LOW] CVE-2024-11053: When asked to both use a `
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches
the redirect target hostname but the entry either omits just the password or
omits both login and password.
OSV
CVE-2024-11053: When asked to both use a `
osv·2024-12-11·CVSS 3.4
CVE-2024-11053 [LOW] CVE-2024-11053: When asked to both use a `
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
GHSA
GHSA-h288-5fq8-5pfw: When asked to both use a `
ghsa_unreviewed·2024-12-11
CVE-2024-11053 [CRITICAL] GHSA-h288-5fq8-5pfw: When asked to both use a `
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches
the redirect target hostname but the entry either omits just the password or
omits both login and password.
No detection rules found.
No public exploits indexed.
Qualys
Oracle Critical Patch Update, April 2025 Security Update Review
blogs_qualys·2025-04-16
Oracle Critical Patch Update, April 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Oracle released its first quarterly edition of this year’s Critical Patch Update. The update received patches for 378 s ecurity vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 103, constituting about 27% of the total patches released. Oracle MySQL and Oracle Communications Applications followed, with 43 and 42 security patches.
300 of the 378 security patches provided by the April Critical Patch Update (about 79%) are for non-Ora
Qualys
Oracle Critical Patch Update, April 2025 Security Update Review | Qualys
blogs_qualys·2025-04-16
Oracle Critical Patch Update, April 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
Oracle released its first quarterly edition of this year’s Critical Patch Update. The update received patches for 378 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 103, constituting about 27% of the total patches released. Oracle MySQL and Oracle Communications Applications followed, with 43 and 42 security patches.
300 of the 378 security patches provided by the April Critical Patch Update (about 79%) are for non
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications followed,
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications fol
HackerOne
CVE-2026-3783: token leak with redirect and netrc
hackerone·2026-03-11·CVSS 5.3
CVE-2026-3783 [MEDIUM] CVE-2026-3783: token leak with redirect and netrc
CVE-2026-3783: token leak with redirect and netrc
##Summary
When `--oauth2-bearer` is used with `--netrc` and curl follows a redirect, the bearer token leaks to the redirect target. The netrc bypass at `http.c:822` skips `Curl_auth_allowed_to_host()`, allowing the token through. This is an incomplete fix for CVE-2025-14524 — the Dec 2025 SASL fix patched `curl_sasl.c` but missed the HTTP bearer path.
This is an incomplete fix for the same vulnerability class as CVE-2025-14524. The Dec 2025 SASL bearer fix (commit `1a822275d3`, PR #19933) patched `lib/curl_sasl.c` but left the HTTP bearer path at `lib/http.c:704-714` unprotected.
## Version
curl 8.10.1 (confirmed), also present in current master `d9c2c64337`. All versions supporting `--oauth2-bearer` with `--netrc` are affected.
**The n
HackerOne
Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c
hackerone·2025-06-22·CVSS 3.4
CVE-2024-11053 [LOW] Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c
Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c
## Summary :
-When parsing a netrc. file, the macdef keyword fails to clear previously loaded credentials. If a redirect follows, these credentials are leaked to the new
host. This is a new variant of CVE-2024-11053, triggered by a different code path ('macdef' instead of 'default').
##No, this vulnerability was discovered through manual code analysis and testing
## Affected version :
curl 8.15.0-DEV (x86_64-pc-linux-gnu) libcurl/8.15.0-DEV OpenSSL/3.5.0 zlib/1.3.1 libpsl/0.21.2
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS Debug HSTS HTTPS-proxy IPv6 La
HackerOne
CVE-2025-0167: netrc and default credential leak
hackerone·2025-02-07·CVSS 3.4
CVE-2025-0167 [LOW] CVE-2025-0167: netrc and default credential leak
CVE-2025-0167: netrc and default credential leak
## Summary:
The fix for CVE-2024-11053 seems to be incomplete.The information leak problem could be reproduced again if use netrc in step1.
## Affected version
all
## Steps To Reproduce:
1. Adapt test479 to use netrc like below(both of user and password are not provided for b.com):
machine a.com
login alice
password alicespassword
default
2.Run test479
3. The test would fail because alice and alicepassword were used for b.com.
I used the latest version curl 8.11.1 but the problem still exists.I'm not sure if this is expected.Please point it out if i'm wrong.
## Impact
## Summary:
Sensitive information disclosure.
HackerOne
netrc and redirect credential leak
hackerone·2025-01-15·CVSS 3.4
[LOW] netrc and redirect credential leak
netrc and redirect credential leak
When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
## Impact
Information disclosure (password sent to the wrong host).
netrc and redirect credential leak
Project curl Security Advisory, December 11th 2024 - https://curl.se/docs/CVE-2024-11053.html
VULNERABILITY
When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain c
HackerOne
CVE-2024-11053: netrc + redirect credential leak
hackerone·2024-12-11·CVSS 3.4
CVE-2024-11053 [LOW] CVE-2024-11053: netrc + redirect credential leak
CVE-2024-11053: netrc + redirect credential leak
## Summary:
Curl has a logic flaw in the way it processes netrc credentials when performing redirects. The redirect will pass along credentials specified for the original host to the redirection target under certain conditions, resulting in unexpected leak of credentials to the redirect target.
## Steps To Reproduce:
1. Have two sites `https://a` and `https://b`. `https://a` does 301 redirect to `https://b`
2. Have netrc file with the following:
```
machine a
login alice
password alicespassword
default
login bob
```
3. `curl -L --netrc-file netrc -v https://a`
Credentials `bob:alicespassword` will be sent to `https://b`.
## Suggested remediation
When parsing netrc file during redirect, if a match is found clear the previous username an
Bugzilla
CVE-2024-11053 curl: curl netrc password leak
bugzilla·2024-12-09·CVSS 3.4
CVE-2024-11053 [LOW] CVE-2024-11053 curl: curl netrc password leak
CVE-2024-11053 curl: curl netrc password leak
When asked to both use a .netrc file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file matches the redirect target
hostname, but the entry omits password or both login & password.
A curl transfer with `a.com` that redirects to `b.com` that uses a `.netrc`
like below (with a match, but no password specified for the second host),
would make curl pass on `alicespassword` as password even in the second
transfer to the separate host `b.com`.
~~~
machine a.com
login alice
password alicespassword
default
login bob
~~~
Discussion:
This issue has been addressed in the following products:
Red Hat
https://curl.se/docs/CVE-2024-11053.htmlhttps://curl.se/docs/CVE-2024-11053.jsonhttps://hackerone.com/reports/2829063http://www.openwall.com/lists/oss-security/2024/12/11/1https://security.netapp.com/advisory/ntap-20250124-0012/https://security.netapp.com/advisory/ntap-20250131-0003/https://security.netapp.com/advisory/ntap-20250131-0004/
2024-12-11
Published