CVE-2024-11053 — netrc and redirect credential leak

Back Back to CVE browser

MEDIUM

netrc and redirect credential leak

Published Dec 11, 2024

5.9

MEDIUM

CVSS 3.1

EPSS 1.35%

Description

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

Affected products

Vendor Curl Product Curl Default
unaffected
- Version
  6.5
  Status
  affected
  Constraints
  <=6.5
- Version
  6.5.1
  Status
  affected
  Constraints
  <=6.5.1
- Version
  6.5.2
  Status
  affected
  Constraints
  <=6.5.2
- Version
  7.1
  Status
  affected
  Constraints
  <=7.1
- Version
  7.1.1
  Status
  affected
  Constraints
  <=7.1.1
- Version
  7.10
  Status
  affected
  Constraints
  <=7.10
- Version
  7.10.1
  Status
  affected
  Constraints
  <=7.10.1
- Version
  7.10.2
  Status
  affected
  Constraints
  <=7.10.2
- Version
  7.10.3
  Status
  affected
  Constraints
  <=7.10.3
- Version
  7.10.4
  Status
  affected
  Constraints
  <=7.10.4
- Version
  7.10.5
  Status
  affected
  Constraints
  <=7.10.5
- Version
  7.10.6
  Status
  affected
  Constraints
  <=7.10.6
- Version
  7.10.7
  Status
  affected
  Constraints
  <=7.10.7
- Version
  7.10.8
  Status
  affected
  Constraints
  <=7.10.8
- Version
  7.11.0
  Status
  affected
  Constraints
  <=7.11.0
- Version
  7.11.1
  Status
  affected
  Constraints
  <=7.11.1
- Version
  7.11.2
  Status
  affected
  Constraints
  <=7.11.2
- Version
  7.12.0
  Status
  affected
  Constraints
  <=7.12.0
- Version
  7.12.1
  Status
  affected
  Constraints
  <=7.12.1
- Version
  7.12.2
  Status
  affected
  Constraints
  <=7.12.2
- Version
  7.12.3
  Status
  affected
  Constraints
  <=7.12.3
- Version
  7.13.0
  Status
  affected
  Constraints
  <=7.13.0
- Version
  7.13.1
  Status
  affected
  Constraints
  <=7.13.1
- Version
  7.13.2
  Status
  affected
  Constraints
  <=7.13.2
- Version
  7.14.0
  Status
  affected
  Constraints
  <=7.14.0
- Version
  7.14.1
  Status
  affected
  Constraints
  <=7.14.1
- Version
  7.15.0
  Status
  affected
  Constraints
  <=7.15.0
- Version
  7.15.1
  Status
  affected
  Constraints
  <=7.15.1
- Version
  7.15.2
  Status
  affected
  Constraints
  <=7.15.2
- Version
  7.15.3
  Status
  affected
  Constraints
  <=7.15.3
- Version
  7.15.4
  Status
  affected
  Constraints
  <=7.15.4
- Version
  7.15.5
  Status
  affected
  Constraints
  <=7.15.5
- Version
  7.16.0
  Status
  affected
  Constraints
  <=7.16.0
- Version
  7.16.1
  Status
  affected
  Constraints
  <=7.16.1
- Version
  7.16.2
  Status
  affected
  Constraints
  <=7.16.2
- Version
  7.16.3
  Status
  affected
  Constraints
  <=7.16.3
- Version
  7.16.4
  Status
  affected
  Constraints
  <=7.16.4
- Version
  7.17.0
  Status
  affected
  Constraints
  <=7.17.0
- Version
  7.17.1
  Status
  affected
  Constraints
  <=7.17.1
- Version
  7.18.0
  Status
  affected
  Constraints
  <=7.18.0
- Version
  7.18.1
  Status
  affected
  Constraints
  <=7.18.1
- Version
  7.18.2
  Status
  affected
  Constraints
  <=7.18.2
- Version
  7.19.0
  Status
  affected
  Constraints
  <=7.19.0
- Version
  7.19.1
  Status
  affected
  Constraints
  <=7.19.1
- Version
  7.19.2
  Status
  affected
  Constraints
  <=7.19.2
- Version
  7.19.3
  Status
  affected
  Constraints
  <=7.19.3
- Version
  7.19.4
  Status
  affected
  Constraints
  <=7.19.4
- Version
  7.19.5
  Status
  affected
  Constraints
  <=7.19.5
- Version
  7.19.6
  Status
  affected
  Constraints
  <=7.19.6
- Version
  7.19.7
  Status
  affected
  Constraints
  <=7.19.7
- Version
  7.2
  Status
  affected
  Constraints
  <=7.2
- Version
  7.2.1
  Status
  affected
  Constraints
  <=7.2.1
- Version
  7.20.0
  Status
  affected
  Constraints
  <=7.20.0
- Version
  7.20.1
  Status
  affected
  Constraints
  <=7.20.1
- Version
  7.21.0
  Status
  affected
  Constraints
  <=7.21.0
- Version
  7.21.1
  Status
  affected
  Constraints
  <=7.21.1
- Version
  7.21.2
  Status
  affected
  Constraints
  <=7.21.2
- Version
  7.21.3
  Status
  affected
  Constraints
  <=7.21.3
- Version
  7.21.4
  Status
  affected
  Constraints
  <=7.21.4
- Version
  7.21.5
  Status
  affected
  Constraints
  <=7.21.5
- Version
  7.21.6
  Status
  affected
  Constraints
  <=7.21.6
- Version
  7.21.7
  Status
  affected
  Constraints
  <=7.21.7
- Version
  7.22.0
  Status
  affected
  Constraints
  <=7.22.0
- Version
  7.23.0
  Status
  affected
  Constraints
  <=7.23.0
- Version
  7.23.1
  Status
  affected
  Constraints
  <=7.23.1
- Version
  7.24.0
  Status
  affected
  Constraints
  <=7.24.0
- Version
  7.25.0
  Status
  affected
  Constraints
  <=7.25.0
- Version
  7.26.0
  Status
  affected
  Constraints
  <=7.26.0
- Version
  7.27.0
  Status
  affected
  Constraints
  <=7.27.0
- Version
  7.28.0
  Status
  affected
  Constraints
  <=7.28.0
- Version
  7.28.1
  Status
  affected
  Constraints
  <=7.28.1
- Version
  7.29.0
  Status
  affected
  Constraints
  <=7.29.0
- Version
  7.3
  Status
  affected
  Constraints
  <=7.3
- Version
  7.30.0
  Status
  affected
  Constraints
  <=7.30.0
- Version
  7.31.0
  Status
  affected
  Constraints
  <=7.31.0
- Version
  7.32.0
  Status
  affected
  Constraints
  <=7.32.0
- Version
  7.33.0
  Status
  affected
  Constraints
  <=7.33.0
- Version
  7.34.0
  Status
  affected
  Constraints
  <=7.34.0
- Version
  7.35.0
  Status
  affected
  Constraints
  <=7.35.0
- Version
  7.36.0
  Status
  affected
  Constraints
  <=7.36.0
- Version
  7.37.0
  Status
  affected
  Constraints
  <=7.37.0
- Version
  7.37.1
  Status
  affected
  Constraints
  <=7.37.1
- Version
  7.38.0
  Status
  affected
  Constraints
  <=7.38.0
- Version
  7.39.0
  Status
  affected
  Constraints
  <=7.39.0
- Version
  7.4
  Status
  affected
  Constraints
  <=7.4
- Version
  7.4.1
  Status
  affected
  Constraints
  <=7.4.1
- Version
  7.4.2
  Status
  affected
  Constraints
  <=7.4.2
- Version
  7.40.0
  Status
  affected
  Constraints
  <=7.40.0
- Version
  7.41.0
  Status
  affected
  Constraints
  <=7.41.0
- Version
  7.42.0
  Status
  affected
  Constraints
  <=7.42.0
- Version
  7.42.1
  Status
  affected
  Constraints
  <=7.42.1
- Version
  7.43.0
  Status
  affected
  Constraints
  <=7.43.0
- Version
  7.44.0
  Status
  affected
  Constraints
  <=7.44.0
- Version
  7.45.0
  Status
  affected
  Constraints
  <=7.45.0
- Version
  7.46.0
  Status
  affected
  Constraints
  <=7.46.0
- Version
  7.47.0
  Status
  affected
  Constraints
  <=7.47.0
- Version
  7.47.1
  Status
  affected
  Constraints
  <=7.47.1
- Version
  7.48.0
  Status
  affected
  Constraints
  <=7.48.0
- Version
  7.49.0
  Status
  affected
  Constraints
  <=7.49.0
- Version
  7.49.1
  Status
  affected
  Constraints
  <=7.49.1
- Version
  7.5
  Status
  affected
  Constraints
  <=7.5
- Version
  7.5.1
  Status
  affected
  Constraints
  <=7.5.1
- Version
  7.5.2
  Status
  affected
  Constraints
  <=7.5.2
- Version
  7.50.0
  Status
  affected
  Constraints
  <=7.50.0
- Version
  7.50.1
  Status
  affected
  Constraints
  <=7.50.1
- Version
  7.50.2
  Status
  affected
  Constraints
  <=7.50.2
- Version
  7.50.3
  Status
  affected
  Constraints
  <=7.50.3
- Version
  7.51.0
  Status
  affected
  Constraints
  <=7.51.0
- Version
  7.52.0
  Status
  affected
  Constraints
  <=7.52.0
- Version
  7.52.1
  Status
  affected
  Constraints
  <=7.52.1
- Version
  7.53.0
  Status
  affected
  Constraints
  <=7.53.0
- Version
  7.53.1
  Status
  affected
  Constraints
  <=7.53.1
- Version
  7.54.0
  Status
  affected
  Constraints
  <=7.54.0
- Version
  7.54.1
  Status
  affected
  Constraints
  <=7.54.1
- Version
  7.55.0
  Status
  affected
  Constraints
  <=7.55.0
- Version
  7.55.1
  Status
  affected
  Constraints
  <=7.55.1
- Version
  7.56.0
  Status
  affected
  Constraints
  <=7.56.0
- Version
  7.56.1
  Status
  affected
  Constraints
  <=7.56.1
- Version
  7.57.0
  Status
  affected
  Constraints
  <=7.57.0
- Version
  7.58.0
  Status
  affected
  Constraints
  <=7.58.0
- Version
  7.59.0
  Status
  affected
  Constraints
  <=7.59.0
- Version
  7.6
  Status
  affected
  Constraints
  <=7.6
- Version
  7.6.1
  Status
  affected
  Constraints
  <=7.6.1
- Version
  7.60.0
  Status
  affected
  Constraints
  <=7.60.0
- Version
  7.61.0
  Status
  affected
  Constraints
  <=7.61.0
- Version
  7.61.1
  Status
  affected
  Constraints
  <=7.61.1
- Version
  7.62.0
  Status
  affected
  Constraints
  <=7.62.0
- Version
  7.63.0
  Status
  affected
  Constraints
  <=7.63.0
- Version
  7.64.0
  Status
  affected
  Constraints
  <=7.64.0
- Version
  7.64.1
  Status
  affected
  Constraints
  <=7.64.1
- Version
  7.65.0
  Status
  affected
  Constraints
  <=7.65.0
- Version
  7.65.1
  Status
  affected
  Constraints
  <=7.65.1
- Version
  7.65.2
  Status
  affected
  Constraints
  <=7.65.2
- Version
  7.65.3
  Status
  affected
  Constraints
  <=7.65.3
- Version
  7.66.0
  Status
  affected
  Constraints
  <=7.66.0
- Version
  7.67.0
  Status
  affected
  Constraints
  <=7.67.0
- Version
  7.68.0
  Status
  affected
  Constraints
  <=7.68.0
- Version
  7.69.0
  Status
  affected
  Constraints
  <=7.69.0
- Version
  7.69.1
  Status
  affected
  Constraints
  <=7.69.1
- Version
  7.7
  Status
  affected
  Constraints
  <=7.7
- Version
  7.7.1
  Status
  affected
  Constraints
  <=7.7.1
- Version
  7.7.2
  Status
  affected
  Constraints
  <=7.7.2
- Version
  7.7.3
  Status
  affected
  Constraints
  <=7.7.3
- Version
  7.70.0
  Status
  affected
  Constraints
  <=7.70.0
- Version
  7.71.0
  Status
  affected
  Constraints
  <=7.71.0
- Version
  7.71.1
  Status
  affected
  Constraints
  <=7.71.1
- Version
  7.72.0
  Status
  affected
  Constraints
  <=7.72.0
- Version
  7.73.0
  Status
  affected
  Constraints
  <=7.73.0
- Version
  7.74.0
  Status
  affected
  Constraints
  <=7.74.0
- Version
  7.75.0
  Status
  affected
  Constraints
  <=7.75.0
- Version
  7.76.0
  Status
  affected
  Constraints
  <=7.76.0
- Version
  7.76.1
  Status
  affected
  Constraints
  <=7.76.1
- Version
  7.77.0
  Status
  affected
  Constraints
  <=7.77.0
- Version
  7.78.0
  Status
  affected
  Constraints
  <=7.78.0
- Version
  7.79.0
  Status
  affected
  Constraints
  <=7.79.0
- Version
  7.79.1
  Status
  affected
  Constraints
  <=7.79.1
- Version
  7.8
  Status
  affected
  Constraints
  <=7.8
- Version
  7.8.1
  Status
  affected
  Constraints
  <=7.8.1
- Version
  7.80.0
  Status
  affected
  Constraints
  <=7.80.0
- Version
  7.81.0
  Status
  affected
  Constraints
  <=7.81.0
- Version
  7.82.0
  Status
  affected
  Constraints
  <=7.82.0
- Version
  7.83.0
  Status
  affected
  Constraints
  <=7.83.0
- Version
  7.83.1
  Status
  affected
  Constraints
  <=7.83.1
- Version
  7.84.0
  Status
  affected
  Constraints
  <=7.84.0
- Version
  7.85.0
  Status
  affected
  Constraints
  <=7.85.0
- Version
  7.86.0
  Status
  affected
  Constraints
  <=7.86.0
- Version
  7.87.0
  Status
  affected
  Constraints
  <=7.87.0
- Version
  7.88.0
  Status
  affected
  Constraints
  <=7.88.0
- Version
  7.88.1
  Status
  affected
  Constraints
  <=7.88.1
- Version
  7.9
  Status
  affected
  Constraints
  <=7.9
- Version
  7.9.1
  Status
  affected
  Constraints
  <=7.9.1
- Version
  7.9.2
  Status
  affected
  Constraints
  <=7.9.2
- Version
  7.9.3
  Status
  affected
  Constraints
  <=7.9.3
- Version
  7.9.4
  Status
  affected
  Constraints
  <=7.9.4
- Version
  7.9.5
  Status
  affected
  Constraints
  <=7.9.5
- Version
  7.9.6
  Status
  affected
  Constraints
  <=7.9.6
- Version
  7.9.7
  Status
  affected
  Constraints
  <=7.9.7
- Version
  7.9.8
  Status
  affected
  Constraints
  <=7.9.8
- Version
  8.0.0
  Status
  affected
  Constraints
  <=8.0.0
- Version
  8.0.1
  Status
  affected
  Constraints
  <=8.0.1
- Version
  8.1.0
  Status
  affected
  Constraints
  <=8.1.0
- Version
  8.1.1
  Status
  affected
  Constraints
  <=8.1.1
- Version
  8.1.2
  Status
  affected
  Constraints
  <=8.1.2
- Version
  8.10.0
  Status
  affected
  Constraints
  <=8.10.0
- Version
  8.10.1
  Status
  affected
  Constraints
  <=8.10.1
- Version
  8.11.0
  Status
  affected
  Constraints
  <=8.11.0
- Version
  8.2.0
  Status
  affected
  Constraints
  <=8.2.0
- Version
  8.2.1
  Status
  affected
  Constraints
  <=8.2.1
- Version
  8.3.0
  Status
  affected
  Constraints
  <=8.3.0
- Version
  8.4.0
  Status
  affected
  Constraints
  <=8.4.0
- Version
  8.5.0
  Status
  affected
  Constraints
  <=8.5.0
- Version
  8.6.0
  Status
  affected
  Constraints
  <=8.6.0
- Version
  8.7.0
  Status
  affected
  Constraints
  <=8.7.0
- Version
  8.7.1
  Status
  affected
  Constraints
  <=8.7.1
- Version
  8.8.0
  Status
  affected
  Constraints
  <=8.8.0
- Version
  8.9.0
  Status
  affected
  Constraints
  <=8.9.0
- Version
  8.9.1
  Status
  affected
  Constraints
  <=8.9.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Curl

unaffected

Version	Status	Constraints
6.5	affected	<=6.5
6.5.1	affected	<=6.5.1
6.5.2	affected	<=6.5.2
7.1	affected	<=7.1
7.1.1	affected	<=7.1.1
7.10	affected	<=7.10
7.10.1	affected	<=7.10.1
7.10.2	affected	<=7.10.2
7.10.3	affected	<=7.10.3
7.10.4	affected	<=7.10.4
7.10.5	affected	<=7.10.5
7.10.6	affected	<=7.10.6
7.10.7	affected	<=7.10.7
7.10.8	affected	<=7.10.8
7.11.0	affected	<=7.11.0
7.11.1	affected	<=7.11.1
7.11.2	affected	<=7.11.2
7.12.0	affected	<=7.12.0
7.12.1	affected	<=7.12.1
7.12.2	affected	<=7.12.2
7.12.3	affected	<=7.12.3
7.13.0	affected	<=7.13.0
7.13.1	affected	<=7.13.1
7.13.2	affected	<=7.13.2
7.14.0	affected	<=7.14.0
7.14.1	affected	<=7.14.1
7.15.0	affected	<=7.15.0
7.15.1	affected	<=7.15.1
7.15.2	affected	<=7.15.2
7.15.3	affected	<=7.15.3
7.15.4	affected	<=7.15.4
7.15.5	affected	<=7.15.5
7.16.0	affected	<=7.16.0
7.16.1	affected	<=7.16.1
7.16.2	affected	<=7.16.2
7.16.3	affected	<=7.16.3
7.16.4	affected	<=7.16.4
7.17.0	affected	<=7.17.0
7.17.1	affected	<=7.17.1
7.18.0	affected	<=7.18.0
7.18.1	affected	<=7.18.1
7.18.2	affected	<=7.18.2
7.19.0	affected	<=7.19.0
7.19.1	affected	<=7.19.1
7.19.2	affected	<=7.19.2
7.19.3	affected	<=7.19.3
7.19.4	affected	<=7.19.4
7.19.5	affected	<=7.19.5
7.19.6	affected	<=7.19.6
7.19.7	affected	<=7.19.7
7.2	affected	<=7.2
7.2.1	affected	<=7.2.1
7.20.0	affected	<=7.20.0
7.20.1	affected	<=7.20.1
7.21.0	affected	<=7.21.0
7.21.1	affected	<=7.21.1
7.21.2	affected	<=7.21.2
7.21.3	affected	<=7.21.3
7.21.4	affected	<=7.21.4
7.21.5	affected	<=7.21.5
7.21.6	affected	<=7.21.6
7.21.7	affected	<=7.21.7
7.22.0	affected	<=7.22.0
7.23.0	affected	<=7.23.0
7.23.1	affected	<=7.23.1
7.24.0	affected	<=7.24.0
7.25.0	affected	<=7.25.0
7.26.0	affected	<=7.26.0
7.27.0	affected	<=7.27.0
7.28.0	affected	<=7.28.0
7.28.1	affected	<=7.28.1
7.29.0	affected	<=7.29.0
7.3	affected	<=7.3
7.30.0	affected	<=7.30.0
7.31.0	affected	<=7.31.0
7.32.0	affected	<=7.32.0
7.33.0	affected	<=7.33.0
7.34.0	affected	<=7.34.0
7.35.0	affected	<=7.35.0
7.36.0	affected	<=7.36.0
7.37.0	affected	<=7.37.0
7.37.1	affected	<=7.37.1
7.38.0	affected	<=7.38.0
7.39.0	affected	<=7.39.0
7.4	affected	<=7.4
7.4.1	affected	<=7.4.1
7.4.2	affected	<=7.4.2
7.40.0	affected	<=7.40.0
7.41.0	affected	<=7.41.0
7.42.0	affected	<=7.42.0
7.42.1	affected	<=7.42.1
7.43.0	affected	<=7.43.0
7.44.0	affected	<=7.44.0
7.45.0	affected	<=7.45.0
7.46.0	affected	<=7.46.0
7.47.0	affected	<=7.47.0
7.47.1	affected	<=7.47.1
7.48.0	affected	<=7.48.0
7.49.0	affected	<=7.49.0
7.49.1	affected	<=7.49.1
7.5	affected	<=7.5
7.5.1	affected	<=7.5.1
7.5.2	affected	<=7.5.2
7.50.0	affected	<=7.50.0
7.50.1	affected	<=7.50.1
7.50.2	affected	<=7.50.2
7.50.3	affected	<=7.50.3
7.51.0	affected	<=7.51.0
7.52.0	affected	<=7.52.0
7.52.1	affected	<=7.52.1
7.53.0	affected	<=7.53.0
7.53.1	affected	<=7.53.1
7.54.0	affected	<=7.54.0
7.54.1	affected	<=7.54.1
7.55.0	affected	<=7.55.0
7.55.1	affected	<=7.55.1
7.56.0	affected	<=7.56.0
7.56.1	affected	<=7.56.1
7.57.0	affected	<=7.57.0
7.58.0	affected	<=7.58.0
7.59.0	affected	<=7.59.0
7.6	affected	<=7.6
7.6.1	affected	<=7.6.1
7.60.0	affected	<=7.60.0
7.61.0	affected	<=7.61.0
7.61.1	affected	<=7.61.1
7.62.0	affected	<=7.62.0
7.63.0	affected	<=7.63.0
7.64.0	affected	<=7.64.0
7.64.1	affected	<=7.64.1
7.65.0	affected	<=7.65.0
7.65.1	affected	<=7.65.1
7.65.2	affected	<=7.65.2
7.65.3	affected	<=7.65.3
7.66.0	affected	<=7.66.0
7.67.0	affected	<=7.67.0
7.68.0	affected	<=7.68.0
7.69.0	affected	<=7.69.0
7.69.1	affected	<=7.69.1
7.7	affected	<=7.7
7.7.1	affected	<=7.7.1
7.7.2	affected	<=7.7.2
7.7.3	affected	<=7.7.3
7.70.0	affected	<=7.70.0
7.71.0	affected	<=7.71.0
7.71.1	affected	<=7.71.1
7.72.0	affected	<=7.72.0
7.73.0	affected	<=7.73.0
7.74.0	affected	<=7.74.0
7.75.0	affected	<=7.75.0
7.76.0	affected	<=7.76.0
7.76.1	affected	<=7.76.1
7.77.0	affected	<=7.77.0
7.78.0	affected	<=7.78.0
7.79.0	affected	<=7.79.0
7.79.1	affected	<=7.79.1
7.8	affected	<=7.8
7.8.1	affected	<=7.8.1
7.80.0	affected	<=7.80.0
7.81.0	affected	<=7.81.0
7.82.0	affected	<=7.82.0
7.83.0	affected	<=7.83.0
7.83.1	affected	<=7.83.1
7.84.0	affected	<=7.84.0
7.85.0	affected	<=7.85.0
7.86.0	affected	<=7.86.0
7.87.0	affected	<=7.87.0
7.88.0	affected	<=7.88.0
7.88.1	affected	<=7.88.1
7.9	affected	<=7.9
7.9.1	affected	<=7.9.1
7.9.2	affected	<=7.9.2
7.9.3	affected	<=7.9.3
7.9.4	affected	<=7.9.4
7.9.5	affected	<=7.9.5
7.9.6	affected	<=7.9.6
7.9.7	affected	<=7.9.7
7.9.8	affected	<=7.9.8
8.0.0	affected	<=8.0.0
8.0.1	affected	<=8.0.1
8.1.0	affected	<=8.1.0
8.1.1	affected	<=8.1.1
8.1.2	affected	<=8.1.2
8.10.0	affected	<=8.10.0
8.10.1	affected	<=8.10.1
8.11.0	affected	<=8.11.0
8.2.0	affected	<=8.2.0
8.2.1	affected	<=8.2.1
8.3.0	affected	<=8.3.0
8.4.0	affected	<=8.4.0
8.5.0	affected	<=8.5.0
8.6.0	affected	<=8.6.0
8.7.0	affected	<=8.7.0
8.7.1	affected	<=8.7.1
8.8.0	affected	<=8.8.0
8.9.0	affected	<=8.9.0
8.9.1	affected	<=8.9.1

Red Hat Enterprise Linux 8

mysql:8.0-8100020250212154709.489197e6

Fixed · RHSA-2025:1673
Red Hat Enterprise Linux 9

mysql-0:8.0.41-2.el9_5

Fixed · RHSA-2025:1671
Red Hat Enterprise Linux 10

curl

Affected
Red Hat Enterprise Linux 10

mysql8.4

Affected
Red Hat Enterprise Linux 6

curl

Out of support scope
Red Hat Enterprise Linux 6

mysql

Not affected
Red Hat Enterprise Linux 7

curl

Out of support scope
Red Hat Enterprise Linux 8

curl

Affected
Red Hat Enterprise Linux 9

curl

Affected
Red Hat JBoss Core Services

jbcs-httpd24-curl

Fix deferred
Red Hat OpenShift Container Platform 4

rhcos

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	mysql:8.0-8100020250212154709.489197e6	Fixed	RHSA-2025:1673
Red Hat Enterprise Linux 9	mysql-0:8.0.41-2.el9_5	Fixed	RHSA-2025:1671
Red Hat Enterprise Linux 10	curl	Affected	n/a
Red Hat Enterprise Linux 10	mysql8.4	Affected	n/a
Red Hat Enterprise Linux 6	curl	Out of support scope	n/a
Red Hat Enterprise Linux 6	mysql	Not affected	n/a
Red Hat Enterprise Linux 7	curl	Out of support scope	n/a
Red Hat Enterprise Linux 8	curl	Affected	n/a
Red Hat Enterprise Linux 9	curl	Affected	n/a
Red Hat JBoss Core Services	jbcs-httpd24-curl	Fix deferred	n/a
Red Hat OpenShift Container Platform 4	rhcos	Fix deferred	n/a

Remediation

Red Hat statement

This issue only affects curl when a `.netrc` file is used and a redirect is performed. Additionally, the `.netrc` must match the target hostname but the followed-to host does not have a password or both login and password configured. Example of a vulnerable .netrc configuration: ~~~ machine a.com login alice password alicespassword default login bob ~~~

Red Hat mitigation

Avoid using the .netrc file together with redirects.

Metrics

1.35% 0.01348

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01348

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.35% (0.01348)	70.46th	v5 (v2026.06.15)
Jun 15, 2026	1.35% (0.01351)	67.77th	v5 (v2026.06.15)
Nov 18, 2025	1.33% (0.01327)	78.21th	v4 (v2025.03.14)
Mar 17, 2025	0.21% (0.00214)	41.95th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00045)	17.70th	v3 (v2023.03.01)

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (12)

http://www.openwall.com/lists/oss-security/2024/12/11/1
Mailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2024-11053
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2331191
Issue Tracking
https://curl.se/docs/CVE-2024-11053.html
Vendor Advisory
https://curl.se/docs/CVE-2024-11053.json
Vendor Advisory
https://hackerone.com/reports/2829063
ExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-11053
https://security.netapp.com/advisory/ntap-20250124-0012/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0003/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0004/
https://www.cve.org/CVERecord?id=CVE-2024-11053
https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2024/12/11/1		Mailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2024-11053		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2331191		Issue Tracking
https://curl.se/docs/CVE-2024-11053.html		Vendor Advisory
https://curl.se/docs/CVE-2024-11053.json		Vendor Advisory
https://hackerone.com/reports/2829063		ExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-11053
https://security.netapp.com/advisory/ntap-20250124-0012/		Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0003/		Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0004/
https://www.cve.org/CVERecord?id=CVE-2024-11053
https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL