CVE-2025-0167

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.

• CVE-2025-0167: fix password leakage issue when using .netrc file with no login or password in default entry and following HTTP redirects

• CVE-2025-0167: fix password leaking when the netrc file has a default entry that omits both login and password

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. The fix was included previously as part of MGAA-2025-0004.

This update for curl fixes the following issues:

• CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
• CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)

This update for curl fixes the following issues:

• CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
• CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)

This update for curl fixes the following issues:

• CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
• CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)

This update for curl fixes the following issues:

• CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
• CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)

This update for curl fixes the following issues:

Security issues fixed:

• CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
• CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)

Other issues fixed:

• Make sure the TLS handshake after a successful STARTTLS command is fully done before further sending/receiving on the connection. (bsc#1235151)

Zhicheng Chen discovered that curl could incorrectly reuse the wrong connection for Negotiate-authenticated HTTP or HTTPS requests. This could result in the use of credentials from a different connection, contrary to expectations. (CVE-2026-1965)

It was discovered that curl incorrectly leaked OAuth2 bearer tokens when following a redirect. This could result in tokens being sent to the wrong host, contrary to expectations. (CVE-2026-3783)

Muhamad Arga Reksapati discovered that curl incorrectly reused existing HTTP proxy connections even if the request used different credentials. This could result in the use of incorrect credentials, contrary to expectations. (CVE-2026-3784)

Daniel Wade discovered that curl incorrectly handled certain memory operations when doing a second SMB request to the same host. An attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 25.10. (CVE-2026-3805)

Yihang Zhou discovered that curl incorrectly reused .netrc file credentials when following redirects. This could result in the use of credentials for a different host, contrary to expectations. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-0167)