CVE-2026-94266

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 8.23.0-1.1

Description libcurl may accidentally return a URL containing credentials when the CURLINFO EFFECTIVE URL option is used with the curl easy getinfo() function, even if the original URL or the redirected URL did not contain them. This occurs when curl retrieves credentials from a .netrc file. The curl command line tool is also affected via the --write-out '%{url effective}' option.

Recommendations Update libcurl to version 8.23.0-1.1.