PT-2026-40984 · Julia · Curl Jll+1

Published 2026-05-04 · Updated 2026-05-04

OSV

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

Related Identifiers

JLSEC-2026-388

Affected Products

Curl Jll

Libcurl Jll

References · 8

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-388 · Vendor Advisory
• https://debian.org/security/2022/dsa-5197 · Vendor Advisory
• https://security.gentoo.org/glsa/202212-01 · Note
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html · Note
• https://security.netapp.com/advisory/ntap-20220609-0008 · Note
• https://hackerone.com/reports/1547048 · Note