When cURL is asked to use a .netrc file to find credentials and a URL includes a username but no password, such as https://user@example.com/, cURL may incorrectly use the password for another user defined for that host. If multiple users are defined for that host, the password for a different user may be used, resulting in credential disclosure. This flaw is a credential‑handling problem (CWE‑289).

The vulnerability affects the cURL command‑line client distributed by the curl project. All releases that support .netrc parsing are potentially impacted, as the advisory does not limit the scope to specific versions or configuration flags. Any installation of cURL invoked with the --netrc option and processing URLs that include a username without a password is at risk.

With the high CVSS score of 9.1 the vulnerability is still rated severe, though the EPSS score remains very low. The issue is not listed in the CISA KEV catalog. The updated description confirms that an attacker would need to supply a crafted URL containing a username without a password to a local or controlled instance of cURL. The flaw does not provide code execution or privileged escalation; it only impairs confidentiality by exposing stored credentials. The overall risk is high for environments that store sensitive credentials in .netrc files and allow untrusted input to influence cURL calls.