CVE-2026-3783

Katalog CVE

CVSS 5.3 · Medium EPSS 0,53%

Kerentanan Insufficiently Protected Credentials pada haxx curl. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 42,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2026-3783.html patch · advisory vendor
• https://curl.se/docs/CVE-2026-3783.json advisory vendor
• https://hackerone.com/reports/3583983 exploit · issue tracking · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/03/11/2 mailing list · advisory pihak ketiga