{"advisories":[{"id":"USN-8084-1","source":"usn","title":"curl vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8084-1"},{"id":"USN-8099-1","source":"usn","title":"curl vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8099-1"}],"cve":"CVE-2026-3783","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.18.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.17.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.16.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.15.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.14.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.14.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.13.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.12.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.12.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.11.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.11.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.10.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.10.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.9.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.9.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.8.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.7.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.7.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.6.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.5.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.4.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.3.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.2.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.2.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.1.2"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.1.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.1.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.0.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"8.0.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.88.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.88.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.87.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.86.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.85.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.84.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.83.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.83.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.82.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.81.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.80.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.79.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.79.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.78.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.77.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.76.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.76.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.75.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.74.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.73.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.72.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.71.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.71.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.70.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.69.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.69.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.68.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.67.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.66.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.65.3"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.65.2"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.65.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.65.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.64.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.64.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.63.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.62.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.61.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.61.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.60.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.59.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.58.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.57.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.56.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.56.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.55.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.55.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.54.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.54.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.53.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.53.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.52.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.52.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.51.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.50.3"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.50.2"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.50.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.50.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.49.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.49.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.48.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.47.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.47.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.46.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.45.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.44.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.43.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.42.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.42.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.41.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.40.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.39.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.38.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.37.1"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.37.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.36.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.35.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.34.0"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"7.33.0"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"curl","source":"cna","vendor":"curl"},"product":"curl","vendor":"curl"}],"analysis":{"en":{"generated_at":"2026-03-16T23:46:26.235579+00:00","value":{"mitigation_remediation":["Update curl to a version that includes a fix for CVE-2026-3783","If upgrading is not immediately possible, configure curl to ignore or disable the .netrc file (e.g., use -n or --netrc-optional) when performing requests that may involve redirects","Avoid using OAuth bearer tokens in contexts that might trigger redirects to hosts with .netrc entries","Check the vendor’s website or security advisories for the latest patch information"],"summary":{"action":"Patch","impact":"Sensitive Credential Leakage"},"threat_synthesis":{"affected_systems":"Affected product: Haxx’s curl library (denoted by cpe:2.3:a:haxx:curl). No specific version information is supplied in the current data set; users should consult the vendor advisories for patch details.","description_and_impact":"When curl performs an HTTP(S) transfer using an OAuth2 bearer token and that transfer follows a redirect to a second URL, the client may inadvertently transmit the bearer token to the second host. Because curl associates the token with the original hostname, if the redirected-to hostname matches an entry in the user’s .netrc file (via the `machine` or `default` keyword), that token is added to the request for the second service. This results in accidental exposure of the bearer token, which can be used by an attacker to impersonate the user on a different service. The vulnerability is classified under CWE‑201 (Information Exposure) and CWE‑522 (Insufficiently Protected Credentials).","risk_and_exploitability":"The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to control or influence the redirect URL that points to a hostname containing .netrc credentials while the client is making a bearer‑token request to the original host. The likely attack vector is a malicious redirect or misconfiguration that causes curl to forward sensitive credentials to an unintended host."}}}},"created":"2026-03-12T10:06:04.726307+00:00","updated":"2026-03-20T14:37:25.710516+00:00","vendors":["curl","curl$PRODUCT$curl"]},"epss":{"score":0.00495},"mitre":{"cpes":[],"created":"2026-03-11T10:09:08.746000+00:00","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/3xxx/CVE-2026-3783.json","references":["https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983"],"title":"token leak with redirect and netrc","updated":"2026-09-15T06:02:52.569000+00:00","vendors":[],"weaknesses":["CWE-522"]},"nvd":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"created":"2026-03-11T11:16:00.080000+00:00","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-3783.json","references":["http://www.openwall.com/lists/oss-security/2026/03/11/2","https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983"],"title":null,"updated":"2026-09-15T07:16:27.720000+00:00","vendors":["haxx","haxx$PRODUCT$curl"],"weaknesses":["CWE-522"]},"opencve":{"changes":[{"created":"2026-03-11T10:30:00+00:00","data":[{"details":{"new":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","old":null},"type":"description"},{"details":{"new":"token leak with redirect and netrc","old":null},"type":"title"},{"details":{"added":["https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983"],"removed":[]},"type":"references"}],"id":"4b4d8337-0130-40d5-806d-6ee870375b18"},{"created":"2026-03-11T11:30:00+00:00","data":[{"details":{"added":["http://www.openwall.com/lists/oss-security/2026/03/11/2"],"removed":[]},"type":"references"}],"id":"47de7883-dcf5-4de7-acae-dceca3f5c224"},{"created":"2026-03-11T15:15:00+00:00","data":[{"details":{"added":["CWE-522"],"removed":[]},"type":"weaknesses"},{"details":{"added":{"cvssV3_1":{"score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"ssvc":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"f94ce64e-c08b-4eae-8027-feebbf1e89cb"},{"created":"2026-03-12T10:15:00+00:00","data":[{"details":["curl","curl$PRODUCT$curl"],"type":"first_time"},{"details":{"added":["curl","curl$PRODUCT$curl"],"removed":[]},"type":"vendors"}],"id":"9fc873ac-9602-454d-bbdf-9c4f9f9bf691"},{"created":"2026-03-12T14:15:00+00:00","data":[{"details":["haxx","haxx$PRODUCT$curl"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["haxx","haxx$PRODUCT$curl"],"removed":[]},"type":"vendors"}],"id":"0cee5312-4d89-4c36-ba09-bd5edae391bb"},{"created":"2026-03-13T00:15:00+00:00","data":[{"details":{"added":["CWE-201"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://nvd.nist.gov/vuln/detail/CVE-2026-3783","https://www.cve.org/CVERecord?id=CVE-2026-3783"],"removed":[]},"type":"references"},{"details":{"added":{},"removed":{},"updated":{"threat_severity":{"new":"Moderate","old":null}}},"type":"metrics"}],"id":"ceb9d8fd-3792-48a6-8699-52fa79f458a9"}],"cpes":{"data":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2026-03-11T10:09:08+00:00","provider":"redhat"},"description":{"data":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"provider":"vulnrichment"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00495},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":"Moderate","provider":"redhat"}},"references":{"data":["http://www.openwall.com/lists/oss-security/2026/03/11/2","https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983","https://nvd.nist.gov/vuln/detail/CVE-2026-3783","https://www.cve.org/CVERecord?id=CVE-2026-3783"],"providers":["mitre","nvd","redhat"]},"title":{"data":"token leak with redirect and netrc","provider":"mitre"},"updated":{"data":"2026-03-20T14:37:25.710516+00:00","provider":"enrichment"},"vendors":{"data":["curl","curl$PRODUCT$curl","haxx","haxx$PRODUCT$curl"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-201","CWE-522"],"providers":["mitre","nvd","redhat","vulnrichment"]}},"redhat":{"cpes":[],"created":"2026-03-11T10:09:08+00:00","description":"A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"},"threat_severity":"Moderate"},"redhat_repo_path":"2026/CVE-2026-3783.json","references":["http://www.openwall.com/lists/oss-security/2026/03/11/2","https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983","https://nvd.nist.gov/vuln/detail/CVE-2026-3783","https://www.cve.org/CVERecord?id=CVE-2026-3783"],"title":"curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect","updated":"2026-03-11T10:09:08+00:00","vendors":[],"weaknesses":["CWE-201"]},"vulnrichment":{"cpes":[],"created":"2026-03-11T10:09:08.746000+00:00","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"token leak with redirect and netrc","updated":"2026-03-11T14:20:06.946000+00:00","vendors":[],"vulnrichment_repo_path":"2026/3xxx/CVE-2026-3783.json","weaknesses":["CWE-522"]}}