Partial password leak over DNS on HTTP redirect

{
  "id": "8c71381d93864825f2085b8cf8ac6031ef02b820fd576402bc5c3715f18a7c6f",
  "url": "https://osv.dev/vulnerability/CURL-CVE-2020-8169",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Partial password leak over DNS on HTTP redirect",
    "summary": "libcurl can be tricked to prepend a part of the password to the hostname before it resolves it, potentially leaking the partial password over the network and to the DNS server(s). libcurl can be given a username and password for HTTP authentication when requesting an HTTP resource - used for HTTP Authentication such as Basic, Digest, NTLM and similar. The credentials are set, either together with `CURLOPT_USERPWD` or separately with `CURLOPT_USERNAME` and `CURLOPT_PASSWORD`. Important detail: these strings are given to libcurl as plain C strings and they are not supposed to be URL encoded. In addition, libcurl also allows the credentials to be set in the URL, using the standard RFC 3986 format: `http://user:password@host/path`. In this case, the name and password are URL encoded as that is how they appear in URLs. If the options are set, they override the credentials set in the URL. Internally, this is handled by storing the credentials in the \"URL object\" so that there is only a single set of credentials stored associated with this single URL. When libcurl handles a relative redirect (as opposed to an absolute URL redirect) for an HTTP transfer, the server is only sending a new path to the client and that path is applied on to the existing URL. That \"applying\" of the relative path on top of an absolute URL is done by libcurl first generating a full absolute URL out of all the components it has, then it applies the redirect and finally it deconstructs the URL again into its s",
    "evidence": "osv:CURL-CVE-2020-8169",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CURL-CVE-2020-8169",
      "aliases": [
        "CURL-CVE-2020-8169",
        "CVE-2020-8169"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "7.62.0"
                },
                {
                  "fixed": "7.71.0"
                }
              ]
            },
            {
              "repo": "https://github.com/curl/curl.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "46e164069d1a5230e4e64cbd2ff46c46cce056bb"
                },
                {
                  "fixed": "600a8cded447cd7118ed50142c576567c0cf5158"
                }
              ]
            }
          ],
          "versions": [
            "7.70.0",
            "7.69.1",
            "7.69.0",
            "7.68.0",
            "7.67.0",
            "7.66.0",
            "7.65.3",
            "7.65.2",
            "7.65.1",
            "7.65.0",
            "7.64.1",
            "7.64.0",
            "7.63.0",
            "7.62.0",
            "curl-7_70_0",
            "curl-7_69_1",
            "curl-7_69_0",
            "curl-7_68_0",
            "curl-7_67_0",
            "curl-7_66_0",
            "curl-7_65_3",
            "curl-7_65_2",
            "curl-7_65_1",
            "curl-7_65_0",
            "curl-7_64_1",
            "curl-7_64_0",
            "curl-7_63_0",
            "curl-7_62_0"
          ],
          "database_specific": {
            "source": "https://curl.se/docs/CURL-CVE-2020-8169.json",
            "vanir_signatures": [
              {
                "id": "CURL-CVE-2020-8169-cab8ceb3",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "217365021735622922918859470819958719416",
                    "80021121807422128614266942640560911129",
                    "83572684787688603986561731392017869653",
                    "256254734209451092000570606288814405394",
                    "22710865864027847139479811317331621865",
                    "315779185918838238311757308293173266891",
                    "233884227831028467700585199722282121829",
                    "84056341486696531137256277355447071794",
                    "290975024690734492127336789636909542842"
                  ]
                },
                "source": "https://github.com/curl/curl.git/commit/600a8cded447cd7118ed50142c576567c0cf5158",
                "target": {
                  "file": "lib/url.c"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              },
              {
                "id": "CURL-CVE-2020-8169-cf32f31b",
                "digest": {
                  "length": 1951,
                  "function_hash": "248168642815063162738911145346572393921"
                },
                "source": "https://github.com/curl/curl.git/commit/600a8cded447cd7118ed50142c576567c0cf5158",
                "target": {
                  "file": "lib/url.c",
                  "function": "override_login"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              }
            ],
            "vanir_signatures_modified": "2026-10-27T01:28:35Z"
          }
        }
      ],
      "modified": "2026-10-27T01:28:35.045489466Z",
      "provider": "osv",
      "references": [],
      "provider_metadata": {
        "CWE": {
          "id": "CWE-200",
          "desc": "Exposure of Sensitive Information to an Unauthorized Actor"
        },
        "URL": "https://curl.se/docs/CVE-2020-8169.json",
        "www": "https://curl.se/docs/CVE-2020-8169.html",
        "award": {
          "amount": "400",
          "currency": "USD"
        },
        "issue": "https://hackerone.com/reports/874778",
        "affects": "both",
        "package": "curl",
        "severity": "Medium",
        "last_affected": "7.70.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2020-8169",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 459158,
  "published_at": "2020-06-24T08:00:00+00:00"
}