When cURL is instructed to retrieve credentials from a .netrc file while processing a URL that supplies a username but omits a password—such as https://user@example.com/—it may mistakenly select the password for a different user defined for that host in the .netrc file when no matching entry exists for the specified user. This flaw, classified as CWE‑289, results in unauthorized disclosure of a credential rather than code execution.

The bug affects the cURL command‑line client distributed by the curl project. All releases that support .netrc parsing are potentially impacted; the advisory does not restrict the issue to specific versions or configuration flags. Any installation of cURL that is invoked with the --netrc option and processes URLs containing a username but no password is at risk.

The CVSS score of 9.1 indicates a high severity vulnerability. The EPSS score of less than 1 % suggests that, at the time of this analysis, exploitation is unlikely, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is an attacker supplying a crafted URL that includes a username but omits a password to a local or controlled instance of cURL with the --netrc option enabled; this inference is based on the description. Because the flaw only discloses credentials, it does not allow code execution or privilege escalation, but it does compromise confidentiality whenever an attacker can influence the URL passed to cURL.