cyfenced.com →

[ CVE-2026-94266 · Published 20 Oct 2026 ]

Vulnerability in curl

Not scored yet EPSS <1%2 agency advisoriesNo fix listed yet

[ Description ]Official description

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1307

    Multiple vulnerabilities in Curl Translated from French

    Multiple vulnerabilities have been discovered in Curl. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

    CVE-2026-94265CVE-2026-87863CVE-2026-107928+23 more CVEs
  • BSI CERT-BundWID-SEC-2026-3904

    cURL: Multiple vulnerabilities Translated from German

    CVE-2026-87861CVE-2026-86412CVE-2026-92391+20 more CVEs

[ References ]References