CVE-2026-94266

Description

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

Traduire en français

Produits concernés

• curl

Références

• https://curl.se/docs/CVE-2026-94266.html
• https://curl.se/docs/CVE-2026-94266.json
• https://hackerone.com/reports/4041053

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories