CVE-2026-6429

MediumCVSS 5.3/10Last modified Sep 15, 2026

Description

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2026
Last modified
Sep 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-642905.5In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a cCVE-2026-642915.5In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() acceptsCVE-2026-642925.5In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq meCVE-2026-642937.8In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read The bCVE-2026-642945.5In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idCVE-2026-642955.5In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid CVE-2026-642967.8In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat_find_dir_entry() In exfat_find_dCVE-2026-642975.5In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_extend_max_pages() moCVE-2026-642987.1In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX reqCVE-2026-642997.1In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fielCVE-2026-643007.8In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[CVE-2026-643015.5In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() s
CVE-2026-6429: Medium severity, CVSS 5.3 | Vulnix