Description
When asked to use a `.netrc` file for credentials **and** to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has a `default` entry that
omits both login and password. A rare circumstance.
Published: 2025-02-05
Score: 3.4 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-1518 When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.
Ubuntu USN Ubuntu USN USN-8084-1 curl vulnerabilities
History

Wed, 30 Jul 2025 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Haxx
Haxx curl
Netapp
Netapp bootstrap Os
Netapp element Software
Netapp h300s
Netapp h300s Firmware
Netapp h410c
Netapp h410c Firmware
Netapp h410s
Netapp h410s Firmware
Netapp h500s
Netapp h500s Firmware
Netapp h610c
Netapp h610c Firmware
Netapp h610s
Netapp h610s Firmware
Netapp h615c
Netapp h615c Firmware
Netapp h700s
Netapp h700s Firmware
Netapp hci Compute Node
Netapp ontap
Netapp ontap Select Deploy Administration Utility
Netapp ontap Tools
Netapp solidfire \& Hci Management Node
Netapp solidfire \& Hci Storage Node
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
Vendors & Products Haxx
Haxx curl
Netapp
Netapp bootstrap Os
Netapp element Software
Netapp h300s
Netapp h300s Firmware
Netapp h410c
Netapp h410c Firmware
Netapp h410s
Netapp h410s Firmware
Netapp h500s
Netapp h500s Firmware
Netapp h610c
Netapp h610c Firmware
Netapp h610s
Netapp h610s Firmware
Netapp h615c
Netapp h615c Firmware
Netapp h700s
Netapp h700s Firmware
Netapp hci Compute Node
Netapp ontap
Netapp ontap Select Deploy Administration Utility
Netapp ontap Tools
Netapp solidfire \& Hci Management Node
Netapp solidfire \& Hci Storage Node

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00055}

epss

{'score': 0.0007}


Fri, 07 Mar 2025 01:30:00 +0000

Type Values Removed Values Added
References

Thu, 06 Feb 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 3.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 05 Feb 2025 09:30:00 +0000

Type Values Removed Values Added
Description When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.
Title netrc and default credential leak
References

Subscriptions

Curl Curl
Haxx Curl
Netapp Bootstrap Os Element Software H300s H300s Firmware H410c H410c Firmware H410s H410s Firmware H500s H500s Firmware H610c H610c Firmware H610s H610s Firmware H615c H615c Firmware H700s H700s Firmware Hci Compute Node Ontap Ontap Select Deploy Administration Utility Ontap Tools Solidfire \& Hci Management Node Solidfire \& Hci Storage Node
cve-icon MITRE

Status: PUBLISHED

Assigner: curl

Published:

Updated: 2025-03-07T00:10:48.290Z

Reserved: 2024-12-31T23:07:29.650Z

Link: CVE-2025-0167

cve-icon Vulnrichment

Updated: 2025-03-07T00:10:48.290Z

cve-icon NVD

Status : Analyzed

Published: 2025-02-05T10:15:22.710

Modified: 2025-07-30T19:41:45.080

Link: CVE-2025-0167

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-07-21T15:17:50Z

Weaknesses