When cURL is given a URL that contains a username but no password, such as https://user@example.com/, and it is instructed to read a .netrc file, the program may mistakenly retrieve the password for a different user entry that exists for that host. This results in the unintended disclosure of a stored password to the requester. The weakness lies in the handling of credential lookups and falls under multiple categories of credential management flaws.

The vulnerability impacts the command‑line client distributed by the curl project. All releases that support .netrc parsing can be affected when invoked with the --netrc option and a URL that supplies a username without a password. The advisory flags this as a security issue for every cURL installation that may use .netrc files for authentication.

The CVSS score of 9.1 classifies this flaw as critical, yet the EPSS score of less than 1 % indicates that, at present, exploitation is unlikely. The vulnerability is not catalogued in the CISA KEV list. Attackers would need the ability to influence the URL passed to a local or otherwise controlled cURL instance that is running with the --netrc option enabled. A crafted request can cause the program to leak a password that belongs to a different user for the same host, thereby breaching confidentiality.