PT-2025-5688 · Curl+8 · Curl+8

Daniel Stenberg

+1

·

Published

2025-02-05

·

Updated

2026-05-18

·

CVE-2025-0167

CVSS v3.1

3.4

Low

VectorAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)
Description When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2025-10235
ALT-PU-2025-2425
ALT-PU-2025-2652
AZL-56478
AZL-56501
BDU:2025-05209
CLEANSTART-2026-AY18527
CLEANSTART-2026-BW46578
CLEANSTART-2026-DI23929
CLEANSTART-2026-LQ42192
CLEANSTART-2026-OF85770
CVE-2025-0167
JLSEC-2026-420
MGASA-2025-0123
OPENSUSE-SU-2025_0369-1
OPENSUSE-SU-2025_0370-1
SUSE-SU-2025:0369-1
SUSE-SU-2025:0370-1
SUSE-SU-2025:0371-1
SUSE-SU-2025:0372-1
SUSE-SU-2025:20144-1
SUSE-SU-2025_0369-1
SUSE-SU-2025_0370-1
SUSE-SU-2025_0371-1
SUSE-SU-2025_0372-1
USN-8084-1

Affected Products

Alt Linux
Astra Linux
Debian
Ibm Aix
Linuxmint
Red Os
Suse
Ubuntu
Curl