CVE-2026-3783

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3783", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-03-08T05:09:09.891Z", "datePublished": "2026-03-11T10:09:08.746Z", "dateUpdated": "2026-09-15T06:02:52.569Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:52.569Z"}, "title": "token leak with redirect and netrc", "descriptions": [{"lang": "en", "value": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one."}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "7.33.0", "status": "affected", "versionType": "semver", "lessThan": "8.14.2"}, {"version": "8.15.0", "status": "affected", "versionType": "semver", "lessThan": "8.16.1"}, {"version": "8.17.0", "status": "affected", "versionType": "semver", "lessThan": "8.19.0"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "06c1bea72faabb6fad4b7ef818aafaa336c9a7aa", "status": "affected", "versionType": "git", "lessThan": "e3d7401a32a46516c9e5ee877e613e62ed35bddc"}], "defaultStatus": "unaffected", "repo": "https://github.com/curl/curl.git"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8.18.0", "status": "affected"}, {"version": "8.17.0", "status": "affected"}, {"version": "8.16.0", "status": "affected"}, {"version": "8.15.0", "status": "affected"}, {"version": "8.14.1", "status": "affected"}, {"version": "8.14.0", "status": "affected"}, {"version": "8.13.0", "status": "affected"}, {"version": "8.12.1", "status": "affected"}, {"version": "8.12.0", "status": "affected"}, {"version": "8.11.1", "status": "affected"}, {"version": "8.11.0", "status": "affected"}, {"version": "8.10.1", "status": "affected"}, {"version": "8.10.0", "status": "affected"}, {"version": "8.9.1", "status": "affected"}, {"version": "8.9.0", "status": "affected"}, {"version": "8.8.0", "status": "affected"}, {"version": "8.7.1", "status": "affected"}, {"version": "8.7.0", "status": "affected"}, {"version": "8.6.0", "status": "affected"}, {"version": "8.5.0", "status": "affected"}, {"version": "8.4.0", "status": "affected"}, {"version": "8.3.0", "status": "affected"}, {"version": "8.2.1", "status": "affected"}, {"version": "8.2.0", "status": "affected"}, {"version": "8.1.2", "status": "affected"}, {"version": "8.1.1", "status": "affected"}, {"version": "8.1.0", "status": "affected"}, {"version": "8.0.1", "status": "affected"}, {"version": "8.0.0", "status": "affected"}, {"version": "7.88.1", "status": "affected"}, {"version": "7.88.0", "status": "affected"}, {"version": "7.87.0", "status": "affected"}, {"version": "7.86.0", "status": "affected"}, {"version": "7.85.0", "status": "affected"}, {"version": "7.84.0", "status": "affected"}, {"version": "7.83.1", "status": "affected"}, {"version": "7.83.0", "status": "affected"}, {"version": "7.82.0", "status": "affected"}, {"version": "7.81.0", "status": "affected"}, {"version": "7.80.0", "status": "affected"}, {"version": "7.79.1", "status": "affected"}, {"version": "7.79.0", "status": "affected"}, {"version": "7.78.0", "status": "affected"}, {"version": "7.77.0", "status": "affected"}, {"version": "7.76.1", "status": "affected"}, {"version": "7.76.0", "status": "affected"}, {"version": "7.75.0", "status": "affected"}, {"version": "7.74.0", "status": "affected"}, {"version": "7.73.0", "status": "affected"}, {"version": "7.72.0", "status": "affected"}, {"version": "7.71.1", "status": "affected"}, {"version": "7.71.0", "status": "affected"}, {"version": "7.70.0", "status": "affected"}, {"version": "7.69.1", "status": "affected"}, {"version": "7.69.0", "status": "affected"}, {"version": "7.68.0", "status": "affected"}, {"version": "7.67.0", "status": "affected"}, {"version": "7.66.0", "status": "affected"}, {"version": "7.65.3", "status": "affected"}, {"version": "7.65.2", "status": "affected"}, {"version": "7.65.1", "status": "affected"}, {"version": "7.65.0", "status": "affected"}, {"version": "7.64.1", "status": "affected"}, {"version": "7.64.0", "status": "affected"}, {"version": "7.63.0", "status": "affected"}, {"version": "7.62.0", "status": "affected"}, {"version": "7.61.1", "status": "affected"}, {"version": "7.61.0", "status": "affected"}, {"version": "7.60.0", "status": "affected"}, {"version": "7.59.0", "status": "affected"}, {"version": "7.58.0", "status": "affected"}, {"version": "7.57.0", "status": "affected"}, {"version": "7.56.1", "status": "affected"}, {"version": "7.56.0", "status": "affected"}, {"version": "7.55.1", "status": "affected"}, {"version": "7.55.0", "status": "affected"}, {"version": "7.54.1", "status": "affected"}, {"version": "7.54.0", "status": "affected"}, {"version": "7.53.1", "status": "affected"}, {"version": "7.53.0", "status": "affected"}, {"version": "7.52.1", "status": "affected"}, {"version": "7.52.0", "status": "affected"}, {"version": "7.51.0", "status": "affected"}, {"version": "7.50.3", "status": "affected"}, {"version": "7.50.2", "status": "affected"}, {"version": "7.50.1", "status": "affected"}, {"version": "7.50.0", "status": "affected"}, {"version": "7.49.1", "status": "affected"}, {"version": "7.49.0", "status": "affected"}, {"version": "7.48.0", "status": "affected"}, {"version": "7.47.1", "status": "affected"}, {"version": "7.47.0", "status": "affected"}, {"version": "7.46.0", "status": "affected"}, {"version": "7.45.0", "status": "affected"}, {"version": "7.44.0", "status": "affected"}, {"version": "7.43.0", "status": "affected"}, {"version": "7.42.1", "status": "affected"}, {"version": "7.42.0", "status": "affected"}, {"version": "7.41.0", "status": "affected"}, {"version": "7.40.0", "status": "affected"}, {"version": "7.39.0", "status": "affected"}, {"version": "7.38.0", "status": "affected"}, {"version": "7.37.1", "status": "affected"}, {"version": "7.37.0", "status": "affected"}, {"version": "7.36.0", "status": "affected"}, {"version": "7.35.0", "status": "affected"}, {"version": "7.34.0", "status": "affected"}, {"version": "7.33.0", "status": "affected"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-3783.json"}, {"url": "https://curl.se/docs/CVE-2026-3783.html"}, {"url": "https://hackerone.com/reports/3583983"}], "x_osv": {"schema_version": "1.5.0", "id": "CURL-CVE-2026-3783", "aliases": ["CVE-2026-3783"], "summary": "token leak with redirect and netrc", "modified": "2026-09-07T10:34:51.00Z", "database_specific": {"package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-3783.json", "www": "https://curl.se/docs/CVE-2026-3783.html", "issue": "https://hackerone.com/reports/3583983", "CWE": {"id": "CWE-522", "desc": "Insufficiently Protected Credentials"}, "last_affected": "8.18.0", "severity": "Medium"}, "published": "2026-03-11T08:00:00.00Z", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "7.33.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.19.0"}]}, {"type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [{"introduced": "06c1bea72faabb6fad4b7ef818aafaa336c9a7aa"}, {"fixed": "e3d7401a32a46516c9e5ee877e613e62ed35bddc"}]}], "versions": ["8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0"]}], "credits": [{"name": "spectreglobalsec on hackerone", "type": "finder"}, {"name": "Daniel Stenberg", "type": "remediation developer"}], "details": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one."}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insufficiently Protected Credentials", "cweId": "CWE-522", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "spectreglobalsec on hackerone", "type": "finder"}, {"lang": "en", "value": "Daniel Stenberg", "type": "remediation developer"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-11T10:16:31.282Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-522", "lang": "en", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:25:28.836990Z", "id": "CVE-2026-3783", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:26:10.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-11T10:16:31.282Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-3783", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:25:28.836990Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:20:06.946Z"}}], "cna": {"title": "token leak with redirect and netrc", "x_osv": {"id": "CURL-CVE-2026-3783", "aliases": ["CVE-2026-3783"], "credits": [{"name": "spectreglobalsec on hackerone", "type": "finder"}, {"name": "Daniel Stenberg", "type": "remediation developer"}], "details": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.", "summary": "token leak with redirect and netrc", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "7.33.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.19.0"}]}, {"repo": "https://github.com/curl/curl.git", "type": "GIT", "events": [{"introduced": "06c1bea72faabb6fad4b7ef818aafaa336c9a7aa"}, {"fixed": "e3d7401a32a46516c9e5ee877e613e62ed35bddc"}]}], "versions": ["8.18.0", "8.17.0", "8.16.0", "8.15.0", "8.14.1", "8.14.0", "8.13.0", "8.12.1", "8.12.0", "8.11.1", "8.11.0", "8.10.1", "8.10.0", "8.9.1", "8.9.0", "8.8.0", "8.7.1", "8.7.0", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.1", "8.2.0", "8.1.2", "8.1.1", "8.1.0", "8.0.1", "8.0.0", "7.88.1", "7.88.0", "7.87.0", "7.86.0", "7.85.0", "7.84.0", "7.83.1", "7.83.0", "7.82.0", "7.81.0", "7.80.0", "7.79.1", "7.79.0", "7.78.0", "7.77.0", "7.76.1", "7.76.0", "7.75.0", "7.74.0", "7.73.0", "7.72.0", "7.71.1", "7.71.0", "7.70.0", "7.69.1", "7.69.0", "7.68.0", "7.67.0", "7.66.0", "7.65.3", "7.65.2", "7.65.1", "7.65.0", "7.64.1", "7.64.0", "7.63.0", "7.62.0", "7.61.1", "7.61.0", "7.60.0", "7.59.0", "7.58.0", "7.57.0", "7.56.1", "7.56.0", "7.55.1", "7.55.0", "7.54.1", "7.54.0", "7.53.1", "7.53.0", "7.52.1", "7.52.0", "7.51.0", "7.50.3", "7.50.2", "7.50.1", "7.50.0", "7.49.1", "7.49.0", "7.48.0", "7.47.1", "7.47.0", "7.46.0", "7.45.0", "7.44.0", "7.43.0", "7.42.1", "7.42.0", "7.41.0", "7.40.0", "7.39.0", "7.38.0", "7.37.1", "7.37.0", "7.36.0", "7.35.0", "7.34.0", "7.33.0"]}], "modified": "2026-09-07T10:34:51.00Z", "published": "2026-03-11T08:00:00.00Z", "schema_version": "1.5.0", "database_specific": {"CWE": {"id": "CWE-522", "desc": "Insufficiently Protected Credentials"}, "URL": "https://curl.se/docs/CVE-2026-3783.json", "www": "https://curl.se/docs/CVE-2026-3783.html", "issue": "https://hackerone.com/reports/3583983", "affects": "both", "package": "curl", "severity": "Medium", "last_affected": "8.18.0"}}, "credits": [{"lang": "en", "type": "finder", "value": "spectreglobalsec on hackerone"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Stenberg"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "7.33.0", "lessThan": "8.14.2", "versionType": "semver"}, {"status": "affected", "version": "8.15.0", "lessThan": "8.16.1", "versionType": "semver"}, {"status": "affected", "version": "8.17.0", "lessThan": "8.19.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "06c1bea72faabb6fad4b7ef818aafaa336c9a7aa", "lessThan": "e3d7401a32a46516c9e5ee877e613e62ed35bddc", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}, {"status": "affected", "version": "8.10.1"}, {"status": "affected", "version": "8.10.0"}, {"status": "affected", "version": "8.9.1"}, {"status": "affected", "version": "8.9.0"}, {"status": "affected", "version": "8.8.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.6.0"}, {"status": "affected", "version": "8.5.0"}, {"status": "affected", "version": "8.4.0"}, {"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.2.1"}, {"status": "affected", "version": "8.2.0"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.0.1"}, {"status": "affected", "version": "8.0.0"}, {"status": "affected", "version": "7.88.1"}, {"status": "affected", "version": "7.88.0"}, {"status": "affected", "version": "7.87.0"}, {"status": "affected", "version": "7.86.0"}, {"status": "affected", "version": "7.85.0"}, {"status": "affected", "version": "7.84.0"}, {"status": "affected", "version": "7.83.1"}, {"status": "affected", "version": "7.83.0"}, {"status": "affected", "version": "7.82.0"}, {"status": "affected", "version": "7.81.0"}, {"status": "affected", "version": "7.80.0"}, {"status": "affected", "version": "7.79.1"}, {"status": "affected", "version": "7.79.0"}, {"status": "affected", "version": "7.78.0"}, {"status": "affected", "version": "7.77.0"}, {"status": "affected", "version": "7.76.1"}, {"status": "affected", "version": "7.76.0"}, {"status": "affected", "version": "7.75.0"}, {"status": "affected", "version": "7.74.0"}, {"status": "affected", "version": "7.73.0"}, {"status": "affected", "version": "7.72.0"}, {"status": "affected", "version": "7.71.1"}, {"status": "affected", "version": "7.71.0"}, {"status": "affected", "version": "7.70.0"}, {"status": "affected", "version": "7.69.1"}, {"status": "affected", "version": "7.69.0"}, {"status": "affected", "version": "7.68.0"}, {"status": "affected", "version": "7.67.0"}, {"status": "affected", "version": "7.66.0"}, {"status": "affected", "version": "7.65.3"}, {"status": "affected", "version": "7.65.2"}, {"status": "affected", "version": "7.65.1"}, {"status": "affected", "version": "7.65.0"}, {"status": "affected", "version": "7.64.1"}, {"status": "affected", "version": "7.64.0"}, {"status": "affected", "version": "7.63.0"}, {"status": "affected", "version": "7.62.0"}, {"status": "affected", "version": "7.61.1"}, {"status": "affected", "version": "7.61.0"}, {"status": "affected", "version": "7.60.0"}, {"status": "affected", "version": "7.59.0"}, {"status": "affected", "version": "7.58.0"}, {"status": "affected", "version": "7.57.0"}, {"status": "affected", "version": "7.56.1"}, {"status": "affected", "version": "7.56.0"}, {"status": "affected", "version": "7.55.1"}, {"status": "affected", "version": "7.55.0"}, {"status": "affected", "version": "7.54.1"}, {"status": "affected", "version": "7.54.0"}, {"status": "affected", "version": "7.53.1"}, {"status": "affected", "version": "7.53.0"}, {"status": "affected", "version": "7.52.1"}, {"status": "affected", "version": "7.52.0"}, {"status": "affected", "version": "7.51.0"}, {"status": "affected", "version": "7.50.3"}, {"status": "affected", "version": "7.50.2"}, {"status": "affected", "version": "7.50.1"}, {"status": "affected", "version": "7.50.0"}, {"status": "affected", "version": "7.49.1"}, {"status": "affected", "version": "7.49.0"}, {"status": "affected", "version": "7.48.0"}, {"status": "affected", "version": "7.47.1"}, {"status": "affected", "version": "7.47.0"}, {"status": "affected", "version": "7.46.0"}, {"status": "affected", "version": "7.45.0"}, {"status": "affected", "version": "7.44.0"}, {"status": "affected", "version": "7.43.0"}, {"status": "affected", "version": "7.42.1"}, {"status": "affected", "version": "7.42.0"}, {"status": "affected", "version": "7.41.0"}, {"status": "affected", "version": "7.40.0"}, {"status": "affected", "version": "7.39.0"}, {"status": "affected", "version": "7.38.0"}, {"status": "affected", "version": "7.37.1"}, {"status": "affected", "version": "7.37.0"}, {"status": "affected", "version": "7.36.0"}, {"status": "affected", "version": "7.35.0"}, {"status": "affected", "version": "7.34.0"}, {"status": "affected", "version": "7.33.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-3783.json"}, {"url": "https://curl.se/docs/CVE-2026-3783.html"}, {"url": "https://hackerone.com/reports/3583983"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:52.569Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3783", "state": "PUBLISHED", "dateUpdated": "2026-09-15T06:02:52.569Z", "dateReserved": "2026-03-08T05:09:09.891Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2026-03-11T10:09:08.746Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThan": "8.14.2", "status": "affected", "version": "7.33.0", "versionType": "semver"}, {"lessThan": "8.16.1", "status": "affected", "version": "8.15.0", "versionType": "semver"}, {"lessThan": "8.19.0", "status": "affected", "version": "8.17.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "curl", "repo": "https://github.com/curl/curl.git", "vendor": "curl", "versions": [{"lessThan": "e3d7401a32a46516c9e5ee877e613e62ed35bddc", "status": "affected", "version": "06c1bea72faabb6fad4b7ef818aafaa336c9a7aa", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}, {"status": "affected", "version": "8.12.1"}, {"status": "affected", "version": "8.12.0"}, {"status": "affected", "version": "8.11.1"}, {"status": "affected", "version": "8.11.0"}, {"status": "affected", "version": "8.10.1"}, {"status": "affected", "version": "8.10.0"}, {"status": "affected", "version": "8.9.1"}, {"status": "affected", "version": "8.9.0"}, {"status": "affected", "version": "8.8.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.6.0"}, {"status": "affected", "version": "8.5.0"}, {"status": "affected", "version": "8.4.0"}, {"status": "affected", "version": "8.3.0"}, {"status": "affected", "version": "8.2.1"}, {"status": "affected", "version": "8.2.0"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.0.1"}, {"status": "affected", "version": "8.0.0"}, {"status": "affected", "version": "7.88.1"}, {"status": "affected", "version": "7.88.0"}, {"status": "affected", "version": "7.87.0"}, {"status": "affected", "version": "7.86.0"}, {"status": "affected", "version": "7.85.0"}, {"status": "affected", "version": "7.84.0"}, {"status": "affected", "version": "7.83.1"}, {"status": "affected", "version": "7.83.0"}, {"status": "affected", "version": "7.82.0"}, {"status": "affected", "version": "7.81.0"}, {"status": "affected", "version": "7.80.0"}, {"status": "affected", "version": "7.79.1"}, {"status": "affected", "version": "7.79.0"}, {"status": "affected", "version": "7.78.0"}, {"status": "affected", "version": "7.77.0"}, {"status": "affected", "version": "7.76.1"}, {"status": "affected", "version": "7.76.0"}, {"status": "affected", "version": "7.75.0"}, {"status": "affected", "version": "7.74.0"}, {"status": "affected", "version": "7.73.0"}, {"status": "affected", "version": "7.72.0"}, {"status": "affected", "version": "7.71.1"}, {"status": "affected", "version": "7.71.0"}, {"status": "affected", "version": "7.70.0"}, {"status": "affected", "version": "7.69.1"}, {"status": "affected", "version": "7.69.0"}, {"status": "affected", "version": "7.68.0"}, {"status": "affected", "version": "7.67.0"}, {"status": "affected", "version": "7.66.0"}, {"status": "affected", "version": "7.65.3"}, {"status": "affected", "version": "7.65.2"}, {"status": "affected", "version": "7.65.1"}, {"status": "affected", "version": "7.65.0"}, {"status": "affected", "version": "7.64.1"}, {"status": "affected", "version": "7.64.0"}, {"status": "affected", "version": "7.63.0"}, {"status": "affected", "version": "7.62.0"}, {"status": "affected", "version": "7.61.1"}, {"status": "affected", "version": "7.61.0"}, {"status": "affected", "version": "7.60.0"}, {"status": "affected", "version": "7.59.0"}, {"status": "affected", "version": "7.58.0"}, {"status": "affected", "version": "7.57.0"}, {"status": "affected", "version": "7.56.1"}, {"status": "affected", "version": "7.56.0"}, {"status": "affected", "version": "7.55.1"}, {"status": "affected", "version": "7.55.0"}, {"status": "affected", "version": "7.54.1"}, {"status": "affected", "version": "7.54.0"}, {"status": "affected", "version": "7.53.1"}, {"status": "affected", "version": "7.53.0"}, {"status": "affected", "version": "7.52.1"}, {"status": "affected", "version": "7.52.0"}, {"status": "affected", "version": "7.51.0"}, {"status": "affected", "version": "7.50.3"}, {"status": "affected", "version": "7.50.2"}, {"status": "affected", "version": "7.50.1"}, {"status": "affected", "version": "7.50.0"}, {"status": "affected", "version": "7.49.1"}, {"status": "affected", "version": "7.49.0"}, {"status": "affected", "version": "7.48.0"}, {"status": "affected", "version": "7.47.1"}, {"status": "affected", "version": "7.47.0"}, {"status": "affected", "version": "7.46.0"}, {"status": "affected", "version": "7.45.0"}, {"status": "affected", "version": "7.44.0"}, {"status": "affected", "version": "7.43.0"}, {"status": "affected", "version": "7.42.1"}, {"status": "affected", "version": "7.42.0"}, {"status": "affected", "version": "7.41.0"}, {"status": "affected", "version": "7.40.0"}, {"status": "affected", "version": "7.39.0"}, {"status": "affected", "version": "7.38.0"}, {"status": "affected", "version": "7.37.1"}, {"status": "affected", "version": "7.37.0"}, {"status": "affected", "version": "7.36.0"}, {"status": "affected", "version": "7.35.0"}, {"status": "affected", "version": "7.34.0"}, {"status": "affected", "version": "7.33.0"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "matchCriteriaId": "742F398A-5BE6-4B1A-BBE6-2A5FB57B8B3E", "versionEndExcluding": "8.19.0", "versionStartIncluding": "7.33.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one."}, {"lang": "es", "value": "Cuando se utiliza un token portador OAuth2 para una transferencia HTTP(S), y esa transferencia realiza una redirecci\u00f3n a una segunda URL, curl podr\u00eda filtrar ese token al segundo nombre de host bajo algunas circunstancias.\n\nSi el nombre de host al que se redirige la primera solicitud tiene informaci\u00f3n en el archivo .netrc utilizado, con cualquiera de las palabras clave 'machine' o 'default', curl pasar\u00eda el token portador establecido para el primer host tambi\u00e9n al segundo."}], "id": "CVE-2026-3783", "lastModified": "2026-09-15T07:16:27.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3783", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:25:28.836990Z", "version": "2.0.3"}}]}, "published": "2026-03-11T11:16:00.080", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Patch", "Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-3783.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-3783.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3583983"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect", "id": "2446450", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446450"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access."], "mitigation": {"lang": "en:us", "value": "To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations."}, "name": "CVE-2026-3783", "package_state": [{"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Fix deferred", "package_name": "build-of-trustee/trustee-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Fix deferred", "package_name": "confidential-compute-attestation-tech-preview/trustee-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Fix deferred", "package_name": "openshift-sandboxed-containers/osc-operator-bundle", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Fix deferred", "package_name": "openshift-sandboxed-containers/osc-podvm-builder-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Fix deferred", "package_name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Fix deferred", "package_name": "openshift-sandboxed-containers/osc-rhel9-operator", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/cluster-logging-operator-bundle", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/cluster-logging-rhel9-operator", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/eventrouter-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/fluentd-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/log-file-metric-exporter-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/logging-view-plugin-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Fix deferred", "package_name": "openshift-logging/vector-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "s390utils", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/recert-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:trusted_profile_analyzer:2", "fix_state": "Fix deferred", "package_name": "rhtpa/rhtpa-trustification-service-rhel9", "product_name": "Red Hat Trusted Profile Analyzer"}], "public_date": "2026-03-11T10:09:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-3783\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3783\nhttp://www.openwall.com/lists/oss-security/2026/03/11/2\nhttps://curl.se/docs/CVE-2026-3783.html\nhttps://curl.se/docs/CVE-2026-3783.json\nhttps://hackerone.com/reports/3583983"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.18.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.17.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.16.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.15.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.14.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.14.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.13.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.12.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.12.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.11.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.11.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.10.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.10.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.9.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.8.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.6.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.88.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.88.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.87.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.86.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.85.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.84.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.83.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.83.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.82.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.81.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.80.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.79.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.79.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.78.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.77.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.76.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.76.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.75.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.74.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.73.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.72.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.71.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.71.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.70.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.69.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.69.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.68.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.67.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.66.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.65.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.65.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.65.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.65.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.64.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.64.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.63.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.62.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.61.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.61.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.60.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.59.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.58.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.57.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.56.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.56.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.55.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.55.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.54.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.54.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.53.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.53.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.52.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.52.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.51.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.50.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.50.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.50.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.50.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.49.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.49.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.48.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.47.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.47.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.46.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.45.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.44.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.43.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.42.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.42.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.41.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.40.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.39.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.38.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.37.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.37.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.36.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.35.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.34.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.33.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "curl", "source": "cna", "vendor": "curl"}, "product": "curl", "vendor": "curl"}], "analysis": {"en": {"generated_at": "2026-03-16T23:46:26.235579+00:00", "value": {"mitigation_remediation": ["Update curl to a version that includes a fix for CVE-2026-3783", "If upgrading is not immediately possible, configure curl to ignore or disable the .netrc file (e.g., use -n or --netrc-optional) when performing requests that may involve redirects", "Avoid using OAuth bearer tokens in contexts that might trigger redirects to hosts with .netrc entries", "Check the vendor\u2019s website or security advisories for the latest patch information"], "summary": {"action": "Patch", "impact": "Sensitive Credential Leakage"}, "threat_synthesis": {"affected_systems": "Affected product: Haxx\u2019s curl library (denoted by cpe:2.3:a:haxx:curl). No specific version information is supplied in the current data set; users should consult the vendor advisories for patch details.", "description_and_impact": "When curl performs an HTTP(S) transfer using an OAuth2 bearer token and that transfer follows a redirect to a second URL, the client may inadvertently transmit the bearer token to the second host. Because curl associates the token with the original hostname, if the redirected-to hostname matches an entry in the user\u2019s .netrc file (via the `machine` or `default` keyword), that token is added to the request for the second service. This results in accidental exposure of the bearer token, which can be used by an attacker to impersonate the user on a different service. The vulnerability is classified under CWE\u2011201 (Information Exposure) and CWE\u2011522 (Insufficiently Protected Credentials).", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to control or influence the redirect URL that points to a hostname containing .netrc credentials while the client is making a bearer\u2011token request to the original host. The likely attack vector is a malicious redirect or misconfiguration that causes curl to forward sensitive credentials to an unintended host."}}}}, "created": "2026-03-12T10:06:04.726307+00:00", "updated": "2026-03-20T14:37:25.710516+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}