Curl Credential Leak Vulnerability in Debian Packages
Summary
CVE-2025-0167: When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. Affects curl across 2 version ranges.
< 8.12.0-r0
>= 3266b35bbe21c68dea0dc7ccd991eb028e6d360c, < 34cf9d54a46598c44938aa7598820484d7af7133
Fixed in 8.12.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. Curl is integral for developers and system administrators for tasks such as downloading files, testing APIs, and automating web interactions. However, it is susceptible to a vulnerability that can lead to credential leakage under specific conditions, particularly when using a .netrc file for authentication.
Vulnerability Detail
The vulnerability identified as CVE-2025-0167 occurs when curl is instructed to use a .netrc file for credentials while also following HTTP redirects. If the .netrc file contains a default entry that omits both the login and password, there is a risk that the password used for the initial host may be leaked to the redirected host. This flaw is particularly concerning as it can expose sensitive credentials to unintended parties, especially in environments where multiple redirects are common.
How To Fix
Minimum fixed version
8.12.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the .netrc file for authentication or disable HTTP redirects when using curl. This can be done by using the -L option cautiously or by specifying credentials directly in the command line, although this is not recommended for security reasons.
Conclusion
The CVE-2025-0167 vulnerability in curl poses a significant risk of credential leakage when using a .netrc file in conjunction with HTTP redirects. Users are advised to update their curl installations and review their .netrc configurations to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for curl →
FAQ
CVE-2025-0167 is a vulnerability in curl that can lead to credential leakage when using a .netrc file and following HTTP redirects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, consider using workarounds such as avoiding the use of the .netrc file or disabling HTTP redirects.
This vulnerability is considered rare, as it only occurs under specific conditions involving the .netrc file configuration.
More information can be found in the official curl documentation and security advisories, as well as on vulnerability databases.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
