{"id":"CURL-CVE-2026-94266","summary":"password leak in CURLINFO_EFFECTIVE_URL","details":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did.","aliases":["CVE-2026-94266"],"modified":"2026-10-14T07:07:44.262541167Z","published":"2026-10-14T08:00:00Z","database_specific":{"last_affected":"8.22.0","severity":"Low","package":"curl","affects":"both","URL":"https://curl.se/docs/CVE-2026-94266.json","www":"https://curl.se/docs/CVE-2026-94266.html","issue":"https://hackerone.com/reports/4041053","CWE":{"id":"CWE-522","desc":"Insufficiently Protected Credentials"}},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.62.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"46e164069d1a5230e4e64cbd2ff46c46cce056bb"},{"fixed":"7a6bd027d0de2b6857472d35da090ef60cc29f19"}]}],"versions":["8.22.0","8.21.0","8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","8.11.1","8.11.0","8.10.1","8.10.0","8.9.1","8.9.0","8.8.0","8.7.1","8.7.0","8.6.0","8.5.0","8.4.0","8.3.0","8.2.1","8.2.0","8.1.2","8.1.1","8.1.0","8.0.1","8.0.0","7.88.1","7.88.0","7.87.0","7.86.0","7.85.0","7.84.0","7.83.1","7.83.0","7.82.0","7.81.0","7.80.0","7.79.1","7.79.0","7.78.0","7.77.0","7.76.1","7.76.0","7.75.0","7.74.0","7.73.0","7.72.0","7.71.1","7.71.0","7.70.0","7.69.1","7.69.0","7.68.0","7.67.0","7.66.0","7.65.3","7.65.2","7.65.1","7.65.0","7.64.1","7.64.0","7.63.0","7.62.0","rc-8_23_0-1","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","curl-8_18_0","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1","curl-8_17_0","curl-8_16_0","curl-8_15_0","curl-8_14_1","curl-8_14_0","curl-8_13_0","curl-8_12_1","curl-8_12_0","curl-8_11_1","curl-8_11_0","curl-8_10_1","curl-8_10_0","curl-8_9_1","curl-8_9_0","curl-8_8_0","curl-8_7_1","curl-8_7_0","curl-8_6_0","curl-8_5_0","tiny-curl-8_4_0","curl-8_4_0","curl-8_3_0","curl-8_2_1","curl-8_2_0","curl-8_1_2","curl-8_1_1","curl-8_1_0","curl-8_0_1","curl-8_0_0","curl-7_88_1","curl-7_88_0","curl-7_87_0","curl-7_86_0","curl-7_85_0","curl-7_84_0","curl-7_83_1","curl-7_83_0","curl-7_82_0","curl-7_81_0","curl-7_80_0","curl-7_79_1","curl-7_79_0","curl-7_78_0","curl-7_77_0","curl-7_76_1","curl-7_76_0","curl-7_75_0","curl-7_74_0","curl-7_73_0","tiny-curl-7_72_0","curl-7_72_0","curl-7_71_1","curl-7_71_0","curl-7_70_0","curl-7_69_1","curl-7_69_0","curl-7_68_0","curl-7_67_0","curl-7_66_0","curl-7_65_3","curl-7_65_2","curl-7_65_1","curl-7_65_0","curl-7_64_1","curl-7_64_0","curl-7_63_0","curl-7_62_0"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2026-94266.json","vanir_signatures":[{"source":"https://github.com/curl/curl.git/commit/7a6bd027d0de2b6857472d35da090ef60cc29f19","target":{"file":"lib/transfer.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["269207256066394248108905007002679116788","179038389146555669502760471365041299854","56851717317678783285981274959263769100","91758142050887391013194148366522837715"]},"id":"CURL-CVE-2026-94266-63e583af","signature_type":"Line","signature_version":"v1"},{"target":{"file":"lib/getinfo.c"},"deprecated":false,"digest":{"line_hashes":["102422658172101252957580210740003185099","214748731346572310491977030038406671320","231996838768432505579528718713157643491","66188990843086901067395898873945916950","309780150768804229874201619766791550450","5727088785518785898700481521499806177","148002370313541318779154432317600496969","240523656492504870822290541441187594034","150520013801487199793790947322811071865","119226237262923015118676227653110311178","268748901694086432599361815991767857883","194220817738452982644026150430366594809","257609418156129618646541446361125133296","3919700643767886067296231720819544879","141213018459504528811937540161785661028","1358467618996730310022675874355058393"],"threshold":0.9},"id":"CURL-CVE-2026-94266-ab20a11f","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7a6bd027d0de2b6857472d35da090ef60cc29f19"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7a6bd027d0de2b6857472d35da090ef60cc29f19","target":{"function":"Curl_initinfo","file":"lib/getinfo.c"},"deprecated":false,"digest":{"function_hash":"45856926242841989487352146435491725045","length":851},"id":"CURL-CVE-2026-94266-acffde37"},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7a6bd027d0de2b6857472d35da090ef60cc29f19","target":{"file":"lib/transfer.c","function":"Curl_pretransfer"},"deprecated":false,"digest":{"length":3764,"function_hash":"52499367438840249192765432559271831813"},"id":"CURL-CVE-2026-94266-b9ccd5e5","signature_type":"Function"},{"source":"https://github.com/curl/curl.git/commit/7a6bd027d0de2b6857472d35da090ef60cc29f19","target":{"file":"lib/url.c","function":"Curl_close"},"deprecated":false,"digest":{"function_hash":"8925985606996306760467461099671834370","length":2258},"id":"CURL-CVE-2026-94266-e647179e","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["221745276268017443889263548155037073474","99376020635548754651044171079499826385","18985991521237546919439622972463338168","91243489696784857827855541398457212515"],"threshold":0.9},"id":"CURL-CVE-2026-94266-e7253733","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7a6bd027d0de2b6857472d35da090ef60cc29f19","target":{"file":"lib/url.c"}},{"target":{"file":"lib/urldata.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["296795188913388286854389600725575053093","115206756221003183686436806156636699481","138407376028633862097029073221821482400","76938340730917417015326971305328115254"]},"id":"CURL-CVE-2026-94266-ea0a0a53","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7a6bd027d0de2b6857472d35da090ef60cc29f19"},{"id":"CURL-CVE-2026-94266-f04144ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7a6bd027d0de2b6857472d35da090ef60cc29f19","target":{"file":"lib/getinfo.c","function":"getinfo_char"},"deprecated":false,"digest":{"function_hash":"192315924370070938492403642800697261220","length":1830}}],"vanir_signatures_modified":"2026-10-14T07:07:44Z"}}],"schema_version":"1.9.0","credits":[{"name":"Joshua Rogers (Aisle Research)","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}