password leak with netrc and user in URL
CVE-2026-8926 is fixed in 13 products on 1 platform, first by curl 8.18.0-1ubuntu2.2, released June 26, 2026. It is not reported as exploited. Patch Radar priority: High.
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| curl · Debian 14 | 8.21.0~rc2-1 | DEBIAN-CVE-2026-8926 | Jul 24, 2026 |
| curl · RHEL 10 | 8.12.1-1.el10_0.10 | RHSA-2026:72506 | Jul 3, 2026 |
| curl · Ubuntu 25.10 (questing) | 8.14.1-2ubuntu1.4 | curl 8.14.1-2ubuntu1.4 | Jul 3, 2026 |
| curl · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.2 | curl 8.18.0-1ubuntu2.2 | Jun 26, 2026 |
| curl · almalinux 10 | 8.12.1-4.el10_2.6 | ALSA-2026:69125 | Sep 21, 2026 |
| curl · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| curl · ol 10 | 0:8.12.1-4.el10_2.6 | ELSA-2026-69125 | Sep 23, 2026 |
| curl · opensuse-leap 16.0 | 8.14.1-160000.9.1 | OPENSUSE-SU-2026:21774-1 | Sep 6, 2026 |
| curl · rocky 10 | 0:8.12.1-4.el10_2.6 | RLSA-2026:69125 | Sep 22, 2026 |
| curl · sles 15.6 | 8.14.1-150600.4.51.1 | SUSE-SU-2026:4047-1 | Sep 7, 2026 |
| curl · sles 15.7 | 8.14.1-150700.7.23.1 | SUSE-SU-2026:3798-1 | Aug 25, 2026 |
| curl · sles 16.0 | 8.14.1-160000.9.1 | SUSE-SU-2026:23638-1 | Sep 6, 2026 |
| curl-debuginfo · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| curl-debugsource · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| curl-mini · sles 16.0 | 8.14.1-160000.9.1 | SUSE-SU-2026:23638-1 | Sep 6, 2026 |
| curl-minimal · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| curl-minimal-debuginfo · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl · almalinux 10 | 8.12.1-4.el10_2.6 | ALSA-2026:69125 | Sep 21, 2026 |
| libcurl · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl · ol 10 | 0:8.12.1-4.el10_2.6 | ELSA-2026-69125 | Sep 23, 2026 |
| libcurl-debuginfo · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl-devel · almalinux 10 | 8.12.1-4.el10_2.6 | ALSA-2026:69125 | Sep 21, 2026 |
| libcurl-devel · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl-devel · ol 10 | 0:8.12.1-4.el10_2.6 | ELSA-2026-69125 | Sep 23, 2026 |
| libcurl-minimal · almalinux 10 | 8.12.1-4.el10_2.6 | ALSA-2026:69125 | Sep 21, 2026 |
| libcurl-minimal · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl-minimal · ol 10 | 0:8.12.1-4.el10_2.6 | ELSA-2026-69125 | Sep 23, 2026 |
| libcurl-minimal-debuginfo · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl3t64-gnutls · Ubuntu 25.10 (questing) | 8.14.1-2ubuntu1.4 | libcurl3t64-gnutls 8.14.1-2ubuntu1.4 | Jul 3, 2026 |
| libcurl3t64-gnutls · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.2 | libcurl3t64-gnutls 8.18.0-1ubuntu2.2 | Jun 26, 2026 |
| libcurl4t64 · Ubuntu 25.10 (questing) | 8.14.1-2ubuntu1.4 | libcurl4t64 8.14.1-2ubuntu1.4 | Jul 3, 2026 |
| libcurl4t64 · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.2 | libcurl4t64 8.18.0-1ubuntu2.2 | Jun 26, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.