CVE-2026-94266
password leak in CURLINFO_EFFECTIVE_URL
N/A
Published: October 20, 2026 at 08:27 PM UTC
Updated: October 22, 2026 at 04:57 PM UTC
1 product affected across 1 vendorCurl
Using curl by curl?
Get instant alerts when new vulnerabilities affect curl - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%
Description
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
7.62.07.63.07.64.07.64.17.65.07.65.17.65.27.65.37.66.07.67.07.68.07.69.07.69.17.70.07.71.07.71.17.72.07.73.07.74.07.75.07.76.07.76.17.77.07.78.07.79.07.79.17.80.07.81.07.82.07.83.07.83.17.84.07.85.07.86.07.87.07.88.07.88.18.0.08.0.18.1.08.1.18.1.28.10.08.10.18.11.08.11.18.12.08.12.18.13.08.14.08.14.18.15.08.16.08.17.08.18.08.19.08.2.08.2.18.20.08.21.08.22.08.3.08.4.08.5.08.6.08.7.08.7.18.8.08.9.08.9.1
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (3)
Source: cverecord
https://curl.se/docs/CVE-2026-94266.jsonSource: cverecord
https://curl.se/docs/CVE-2026-94266.htmlSource: cverecord
https://hackerone.com/reports/4041053Quick Info
StatusAWAITING ANALYSIS
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card