password leak in CURLINFO_EFFECTIVE_URL
Impact
libcurl could accidentally return a URL for curl_easy_getinfo()'s CURLINFO_EFFECTIVE_URL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
Source excerpt · curlAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
curl · curl
curl
70 ranges
curl · curl
curl
Compare with this publisher’s ranges. This does not inspect your installation.
affected
8.22.0 → through 8.22.0
semver versions
8.21.0 → through 8.21.0
semver versions
8.20.0 → through 8.20.0
semver versions
8.19.0 → through 8.19.0
semver versions
8.18.0 → through 8.18.0
semver versions
8.17.0 → through 8.17.0
semver versions
8.16.0 → through 8.16.0
semver versions
8.15.0 → through 8.15.0
semver versions
8.14.1 → through 8.14.1
semver versions
8.14.0 → through 8.14.0
semver versions
8.13.0 → through 8.13.0
semver versions
8.12.1 → through 8.12.1
semver versions
8.12.0 → through 8.12.0
semver versions
8.11.1 → through 8.11.1
semver versions
8.11.0 → through 8.11.0
semver versions
8.10.1 → through 8.10.1
semver versions
8.10.0 → through 8.10.0
semver versions
8.9.1 → through 8.9.1
semver versions
8.9.0 → through 8.9.0
semver versions
8.8.0 → through 8.8.0
semver versions
8.7.1 → through 8.7.1
semver versions
8.7.0 → through 8.7.0
semver versions
8.6.0 → through 8.6.0
semver versions
8.5.0 → through 8.5.0
semver versions
8.4.0 → through 8.4.0
semver versions
8.3.0 → through 8.3.0
semver versions
8.2.1 → through 8.2.1
semver versions
8.2.0 → through 8.2.0
semver versions
8.1.2 → through 8.1.2
semver versions
8.1.1 → through 8.1.1
semver versions
8.1.0 → through 8.1.0
semver versions
8.0.1 → through 8.0.1
semver versions
8.0.0 → through 8.0.0
semver versions
7.88.1 → through 7.88.1
semver versions
7.88.0 → through 7.88.0
semver versions
7.87.0 → through 7.87.0
semver versions
7.86.0 → through 7.86.0
semver versions
7.85.0 → through 7.85.0
semver versions
7.84.0 → through 7.84.0
semver versions
7.83.1 → through 7.83.1
semver versions
7.83.0 → through 7.83.0
semver versions
7.82.0 → through 7.82.0
semver versions
7.81.0 → through 7.81.0
semver versions
7.80.0 → through 7.80.0
semver versions
7.79.1 → through 7.79.1
semver versions
7.79.0 → through 7.79.0
semver versions
7.78.0 → through 7.78.0
semver versions
7.77.0 → through 7.77.0
semver versions
7.76.1 → through 7.76.1
semver versions
7.76.0 → through 7.76.0
semver versions
7.75.0 → through 7.75.0
semver versions
7.74.0 → through 7.74.0
semver versions
7.73.0 → through 7.73.0
semver versions
7.72.0 → through 7.72.0
semver versions
7.71.1 → through 7.71.1
semver versions
7.71.0 → through 7.71.0
semver versions
7.70.0 → through 7.70.0
semver versions
7.69.1 → through 7.69.1
semver versions
7.69.0 → through 7.69.0
semver versions
7.68.0 → through 7.68.0
semver versions
7.67.0 → through 7.67.0
semver versions
7.66.0 → through 7.66.0
semver versions
7.65.3 → through 7.65.3
semver versions
7.65.2 → through 7.65.2
semver versions
7.65.1 → through 7.65.1
semver versions
7.65.0 → through 7.65.0
semver versions
7.64.1 → through 7.64.1
semver versions
7.64.0 → through 7.64.0
semver versions
7.63.0 → through 7.63.0
semver versions
7.62.0 → through 7.62.0
semver versions
Other versions: unaffected
Original source description
libcurl could accidentally return a URL for curl_easy_getinfo()'s
CURLINFO_EFFECTIVE_URL option containing credentials, even though neither
the URL provided to libcurl nor the redirected URL did.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-94266View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.