Поиск уязвимостей

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.

token leak with redirect and netrc

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that ...

Security update for curl

Security update for curl

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.

Уязвимость программного средства для взаимодействия с серверами cURL, связанная с недостаточной защитой регистрационных данных, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Уязвимость curl

Уязвимость curl

ALT-PU-2026-7685: package `curl` update to version 8.12.0-alt2

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.

use after free in SMB connection reuse

When doing a second SMB request to the same host again, curl would wro ...

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

wrong proxy connection reuse with credentials