ZeroDay Findings
Sign inSign up

Findings

CVE-2026-6429

When asked to both use a file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certa…

Published May 13, 2026 · updated Sep 15, 2026 · haxx curl

When asked to both use a file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 13, 2026 · NIST NVD

    Detected

    When asked to both use a file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

  2. Sep 15, 2026 · NIST NVD

    Updated

    When asked to both use a file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

Affected

  • cpe haxx/curlversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-6429

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-6429

    When asked to both use a file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

    nvd.nist.gov

References