Cyber Resilience

CVE-2026-6429

Haxx Curl 7.14.0 – 8.20.0

Public PoC
Published
13 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0052 41th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-6429 is a medium-severity an unspecified weakness vulnerability in Haxx Curl. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Vulnerability enables leakage of credentials stored in .netrc files to an attacker-controlled host via HTTP redirects.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-8926Same product: Haxx Curl
CVE-2026-8932Same product: Haxx Curl
CVE-2025-5399Same product: Haxx Curl
CVE-2025-10966Same product: Haxx Curl
CVE-2026-7009Same product: Haxx Curl
CVE-2025-14017Same product: Haxx Curl
CVE-2025-13034Same product: Haxx Curl
CVE-2024-9681Same product: Haxx Curl
CVE-2026-5545Same product: Haxx Curl
CVE-2026-8924Same product: Haxx Curl

Affected Assets

haxx
curl
7.14.0 — 8.20.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-4 Information Flow Enforcement
  • AC-6 Least Privilege
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-4 Information Flow Enforcement good match
prevent

Enforces information flow rules so that credentials read from .netrc are never sent to a host other than the one for which they were intended.

AC-6 Least Privilege partial match
prevent

Limits the scope and lifetime of credentials so that even if a redirect occurs the leaked password grants access only to the minimal set of resources.

CM-7 Least Functionality partial match
prevent

Disables or restricts either redirect following or .netrc credential use when both are not strictly required, eliminating the vulnerable combination.

References