Low
password leak with netrc and user in URL
Type: advisorySources: OSV
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-8926
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:39 UTC · Revision 1
Source evidence
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.
osv:CURL-CVE-2026-8926
Complete source record
{
"id": "d4239dfc47bb9a92ee3280ad1dd726eda7a1fc845d2878c8963f2e032ba0c4b7",
"url": "https://osv.dev/vulnerability/CURL-CVE-2026-8926",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "password leak with netrc and user in URL",
"summary": "When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.",
"evidence": "osv:CURL-CVE-2026-8926",
"products": [],
"severity": "low",
"structured": {
"id": "CURL-CVE-2026-8926",
"aliases": [
"CURL-CVE-2026-8926",
"CVE-2026-8926"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "8.11.1"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.20.1"
},
{
"introduced": "8.21.0"
},
{
"fixed": "8.21.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "e9b9bbac22c26cf67316fa8e6c6b9e831af31949"
},
{
"fixed": "4ae1d7cc2643e4773a136395f12bc02fc6867854"
}
]
}
],
"versions": [
"8.20.0",
"8.19.0",
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"curl-8_20_0",
"rc-8_20_0-3",
"rc-8_20_0-2",
"rc-8_20_0-1",
"curl-8_19_0",
"rc-8_19_0-3",
"rc-8_19_0-2",
"rc-8_19_0-1",
"curl-8_18_0",
"rc-8_18_0-3",
"rc-8_18_0-2",
"rc-8_18_0-1",
"curl-8_17_0",
"curl-8_16_0",
"curl-8_15_0",
"curl-8_14_1",
"curl-8_14_0",
"curl-8_13_0",
"curl-8_12_1",
"curl-8_12_0",
"curl-8_11_1"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2026-8926.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2026-8926-021b5398",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153449849528927630982989097409326444008",
"88379421353864512931276900539348573571",
"201790906259196516982199642539528571439",
"40299241035179984831928660998883223605",
"287560083353884473496109498549150325747",
"197861128219458977148990118616636140982",
"300823390809419114206404533543226532407",
"230068627284973658168882594521076757662",
"272411373047526358292730315591370394693",
"69778421462105443834767166246488934338"
]
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/netrc.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-1a33dbc4",
"digest": {
"length": 1495,
"function_hash": "50962543605938728744658837054242069611"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/netrc.c",
"function": "Curl_parsenetrc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-48818554",
"digest": {
"length": 231,
"function_hash": "133367953827436222193372201834699034969"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "tests/unit/unit1304.c",
"function": "t1304_set_creds"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-4cc149d9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"306333511505489786865661738926440731583",
"297182745996420177443888709643651153729",
"155682497118122864171406646506615836236",
"161203233598341192971670476010832044445",
"117685470607660432466480508929899007008",
"210345853957744614174483343152087686288",
"167011082992401313700962850712819384331",
"92003157656527542505791261827142105231",
"63206922067963575840548034895387579661",
"134878177065936273877827519975362346250",
"176907716488435321933696631474611246857",
"77765010955342465165624949676873222807",
"198517712196597726220817807555554108613",
"113916152810517269427989241109859429601",
"261582638910364469581889688587537460216",
"60054651213316664803352133742014260232",
"82370211900869656960507570922025465167",
"127093713284148243595056760810153259000",
"155172733623020065692945917601441926661",
"73471980682516192017384791760067117941",
"204356651921710556561541316648195905524",
"290323086403044532246466746187466839865",
"295945598335387131887330893666155072375",
"174840769796411486996757379765420880681",
"153953601483571611202651978828132252382",
"41833296345774909216870280554109540336",
"322126654751884230309994434131039558279",
"234894155218341610793350164329956141300",
"33950560813951136528224753484677620359",
"216989551634711704422976609195122253169",
"157739629551588411844115014516186941607",
"319941651443817442492257117356193833740",
"155451669800850717487351223695999622743",
"339842083287122113468003294592233458456",
"219256634811657940325779145182197631523",
"55267768380362890161558769168568809598",
"57082152027491008792702909895787971914",
"142709623452343726075474827848957087390",
"7808209497486335222887523990724511608",
"156982431061328017301155361617745281051",
"273618727326665076690406979499488082264",
"86840898485602111524931241713713757627",
"277231269351563306083181029710176005242",
"157739629551588411844115014516186941607",
"319941651443817442492257117356193833740",
"242057465253090078580277958060480022219",
"203037785051438176039518094519761928836",
"187879959607061738645590211831624577394",
"172699187672131135998580521261932793977",
"157739629551588411844115014516186941607",
"319941651443817442492257117356193833740",
"79066467695070172292354748868098455529",
"126633529560175044437987016452290215761",
"206562718589134450088825382167187132893",
"312352557956957201193483625484911347405",
"23567505624374543714452510673515666511",
"55518065497654715105466579914108326768",
"73253255533425785609656231636950683301",
"101949314319640300888416047625512252980",
"117961067943386501755645318168220567849",
"204319434820284243386196743671497470186",
"229421336456152151701483584957083866512",
"251255101469413697030975904167814998413",
"166581975388221143548893459565641988715",
"206562718589134450088825382167187132893",
"312352557956957201193483625484911347405",
"23567505624374543714452510673515666511",
"55518065497654715105466579914108326768",
"73253255533425785609656231636950683301",
"101949314319640300888416047625512252980",
"117961067943386501755645318168220567849",
"204319434820284243386196743671497470186",
"229421336456152151701483584957083866512",
"251255101469413697030975904167814998413",
"166581975388221143548893459565641988715",
"327466795989471448045510205871119336732",
"228676526189418161257139944491847196290",
"128751744782517379745265104063585935553",
"338138157113928982341645069958677833719",
"255399584835731571471456926925960694179",
"224748748807081197958681770927823074564",
"221024565066061379059012932014966675927",
"115002006197579595461025670862873351078",
"101133487996960732911824403507095750663",
"307539649049091386936520732853113943850",
"94799714060553558415409507842946533558",
"327466795989471448045510205871119336732",
"228676526189418161257139944491847196290",
"128751744782517379745265104063585935553",
"338138157113928982341645069958677833719",
"255399584835731571471456926925960694179",
"224748748807081197958681770927823074564",
"221024565066061379059012932014966675927",
"115002006197579595461025670862873351078",
"101133487996960732911824403507095750663",
"184383720836645504198419808649293228825",
"106888819166941318663479174146534842326",
"268136700976305916586588463262632163665",
"129297376620229489526346405327468387758"
]
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "tests/unit/unit1304.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-65e22eba",
"digest": {
"length": 819,
"function_hash": "321629831240895482222938381460659079155"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/netrc.c",
"function": "netrc_finalize"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-6ccbc244",
"digest": {
"length": 1372,
"function_hash": "189374725534919896753670373567969948428"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/netrc.c",
"function": "netrc_hostvalid"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-6f423a44",
"digest": {
"length": 697,
"function_hash": "19849609328383220125119842454829472149"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/netrc.c",
"function": "netrc_handle_token"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-8ea529ac",
"digest": {
"length": 881,
"function_hash": "122055402537300916545786869027960157816"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/netrc.c",
"function": "netrc_get_token"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-949d8900",
"digest": {
"length": 1117,
"function_hash": "311321159553410363188333487242742916565"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/netrc.c",
"function": "parsenetrc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-a05fbb70",
"digest": {
"length": 3405,
"function_hash": "117719298080590776504972744174639573353"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "tests/unit/unit1304.c",
"function": "test_unit1304"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-a8cb32fe",
"digest": {
"length": 612,
"function_hash": "325495557777419585919491541512657363087"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/netrc.c",
"function": "netrc_quoted_token"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-b5179a05",
"digest": {
"length": 105,
"function_hash": "288154463576262713007951120723291160144"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "tests/unit/unit1304.c",
"function": "t1304_stop"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-b9a161f6",
"digest": {
"length": 182,
"function_hash": "217645842825093151435460191831202174849"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/netrc.c",
"function": "netrc_new_machine"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-ced5dba5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"184355673995968637502080442887610462774",
"332067666764284483850612471595849519464",
"29438460884128081081310306430527738667",
"132722566241456851844529776425500546987",
"129996072634781282526321575914267019361",
"184409419170057877432856873014329185481",
"14132239113509141112834698435671095469",
"89697111197315353714186907960064645735",
"160085927935947576679106812480884119997",
"313729432788001578131097773676458976863",
"19805867813516761226217637882544782160",
"125890204767937067690885693976608509884",
"328332844725190034324677143727037409182",
"244081587064524969956688634884518398663",
"191278364241591999448195439961360665457",
"329182561007009955486677698151932354568",
"63690222019870156584013326947399124147",
"205115153486388643893341005832723578354",
"250917669075867049553870158298909558413",
"149477406977026354980871620456989903030",
"191433606155359624536077652332512575548",
"57091599291376278461576254727412357550",
"161866521571780900415137264626089598720",
"313311244461049864856849054709999989037",
"253269755537860746768371029227434064332",
"86877125752960231171332252559919312627",
"166543259522632102656565692930859450749",
"207841199998115448642619893047935559202",
"258698520503446262453142766974608945162",
"231864385584626894425746089306186743358",
"298263254312944473470221718112138939285",
"112415043229222292739863531731539358403",
"140690468055267495683700312380971443400",
"230283225969336496703311439110300574821",
"30638548899332561926445230170543278589",
"117491362008898373369326258967500967045",
"3993087913940417162076720004392892187",
"211343252639127148360978222688901735146",
"250508375551504977726321890616140531655",
"303862975443731158978258001581472545071",
"338482245707065614825913848097300503763",
"72489496432471724799403765757054798065",
"120084891387487019501944858973221707858",
"225092664348642559139507917005922444612",
"5711630025244821851192810530587794707",
"92220563501103194144034329351617455003",
"326334567979165555179364746335603827123",
"167963979283819001745922346774914911423",
"297634567863621433025709302306732297713",
"161965850456263565424027383586091803888",
"222203260069776062926689693851330011630",
"240942867872560716790034939402956261110",
"296400940014763365805476801137736218339",
"284629097916468375161681634911017933991",
"294757866334294469065952540280217397975",
"85272817351204341918606319566754524215",
"66085283695749096847274853461056288557",
"133812561884806187518921631185024603258",
"274454970678907076072800527855366724169",
"87675887021909097154078348878044706293",
"133327072962640251773414646648391626475",
"83655791909881613895268433855291211347",
"21685075685249614042638308586413243582",
"129340862131297411023832301851753583106",
"11680726951044183211823231795724846063",
"249218205697778346648543598167592468747",
"434130209370238447422267655611988385",
"297246561086208927546132292660216775987",
"86799575436553785205159468383749093500",
"201423170256480953517352306473472143239",
"105679677069596742534292086218742672185",
"171622111525120945656737945040654073129",
"174424419141220773609160193893205852272",
"182396787636614940429344706378469649523",
"94986979447887751296667154421827278675",
"169141847189324750730793931452635913751",
"81377277837343731471160145123498989017",
"72882766129721146917087203041458407114",
"150262206826520892712278934124629677893",
"26778570041146454764142051169149033784",
"128048913314928355236749521008525724405",
"244623042314344849816173407282961321080",
"133649644425508784654960772058557748318",
"100468151866771184688792434114559966526",
"300778376185176419049145907796760194649",
"3810747878881087097329810942130414412",
"54927067480347703808454124533889752760",
"146766001881411669745921758153033056158",
"220202680205785275754944190113987460285",
"304831111326618469362850842644746434205",
"5391881227845434872895619035343026623",
"291995676374123513083683654487827114292",
"218868185160447330112278381318832543828",
"259457566442871249409037162121107213507",
"68522405820863547713813362559544388255",
"244765877552995046585552455804985510712",
"336889068187503873131612591263806659920",
"107185474995035452245466601393678469150",
"218573756437523341277437694711619336142",
"293100351825499653367677107356856303449",
"50148842934787275444643829363521333529",
"192244213755085725922511761651283664341",
"212044548768352104749069796875902459924",
"114162958802957163452432265707500394287",
"308642767535812846009013906372388055804",
"135483402194840774211566219350611729918",
"78650322036535697289200244966801213441",
"96079046607175722042507268456911297990",
"65986648451493323385249598472966607934",
"113429151468540053885606138695556544613",
"328939788572323568880479921976728826678",
"124957318419653093457177080619052877469",
"195513227250249782953660602548249214821",
"204172369936556474692701921802354164049",
"65996846107451401283383384411962761852",
"40284571697340306807201438329250751888",
"147929566024190706640431867873647763233",
"162138056430635234986652162355940206448",
"112497787599673996106314733959367039816",
"77469191210834695163732809711755019849",
"235795142144889381791017671228717680591",
"205882418109456628650681567429400448857",
"242971299814522195179129384402884358090",
"96090390940815305688905906737230748201",
"251650374431504181014670333671428915388",
"85073357830370787574184432541266665224",
"280308233165367013112629062421053514251",
"275810560548344406112712992146346970212",
"74073371332751616841560579105585022013",
"56059222136197956446912281718311541667",
"85073357830370787574184432541266665224",
"252458805842136140144679413611678960331",
"175663217679854327677950246709512030508",
"170943920012628529006866836353754259031",
"301272649239740329172819073403834601981",
"284642008672062876023105116589288049525",
"130195789725225685824844780552250254072",
"68500920455666736795118328735323335780",
"102626413907323744259295358613246170220",
"208841251639524719549645882890790061108",
"305109163082701846930155127811999989291",
"124906193307891314665089531110558154096",
"338991574254721606824019962462150458437",
"143306758877800068343205702972518807874",
"199154702217985814266172565622947997455",
"240323176041625846922406306804449634260",
"25515897018509971694219398331416406710",
"252052372440077204622843926266560295110",
"135112139553709285233738443810385255297",
"95478260156539233401849855047364164758",
"197040054378101973763802176269471663533",
"216921154549519030365081787996947959288",
"94728825448618012177027057019473594298",
"91223465297622060211990498561597614914",
"323893525176552089550522787911026302209",
"308121455750124403810142648895194382276",
"62747648734620972688884916392326433025",
"251548059423817921717339159647191249066",
"95443398140180316484346881034918270242",
"115590091665390881428223564105149936950",
"234602114860551064607232708262280932811",
"63953026288583548567851726234191770450",
"70305953360665382779140835686590839244",
"312883637949219566468782851173088101898",
"197715744931774111497260988705624785807",
"25095571359081231171160472514118151161",
"273496259986793086600735729001333528376",
"55349754034911865056869917310661850953",
"207346464578370666427775213071271886964",
"230225115865723225988488874594597384707",
"72327955869252003979741680816487220982",
"47473763315619449226577972074212958878",
"115011220468787673212681760465531593854",
"278968343980020990476069122669224190620",
"147627691247925595184963546832062017205",
"34087404377363134815966438934370578913",
"244301175952353958420042609442686341695",
"321496386486567118220250181013187729071",
"92074165158212724951812397330860507824",
"182408137582930368071988381408120270760",
"281790483639667873630537580649372548575",
"265626666689813881522359949273086205263",
"254691415445048610392536854175741881311",
"197571791191356643992927699100222498662",
"129747843127511230180868119148881306965",
"283070153233968401314333627720661342533",
"14170901654731322762952763709986992469",
"198913671845955587095519999654562477290",
"333444513947821821696843013232706948990",
"325068755425419219449603725333008630991",
"135796034845412565798318482278250437716",
"43287205671247630519422635859283877845",
"120888272867057341246800464636290343296",
"94874502211927286471182736600900098804",
"96922692834516189672771430267746485660",
"133682705682375149488478248758504288092",
"109525305337564433546895370548506265768",
"205528089760757688484844371275215417075",
"100288966099122947375702537865822311459",
"152741285239254159930902144293507382476",
"208125920252001860982214525666181936962",
"301590464376234457906059098915988376943",
"279978651492363048960522303481893661098",
"27091522442804466997943214388307928732",
"202168683903606373138000567843815128023",
"3915544778091126114018720893015093580",
"138209072795570603819615172191787546953",
"288568163533079412439722130232193435393",
"173467210407609297463231583913777653060",
"292918558262598315632860395761847277052",
"51259338380763906736891014019960550465",
"120901382333664661738180187260394824626",
"148940335894876734969574302136513786724",
"298854174291785256839588169572559381802",
"258872181350551226085934900527640973294",
"238263419036230628678147423591215123532",
"309510245878991206512451228285670465343",
"41073332812651993882371544227033212286",
"9970665756752750599819711431489691351",
"329559988080430604294318965626577999829",
"336174682780279118358978499730436963738",
"43869255001240144319948517558196140569",
"243991357599981551210368124863211768176",
"335605474569515826886365400940409397660",
"27091522442804466997943214388307928732",
"202168683903606373138000567843815128023",
"3915544778091126114018720893015093580",
"255428913116168448286374556279402931137",
"222297999412893204253795418093179821453",
"134881382704022795617690610555980595212",
"96923536341414704383696440585803394024",
"794256036946920129018567873186410085",
"236513112638990241774851869648891719701",
"134210554754258914848633935665003966986",
"117334259238756248571081744897650560091",
"284337463481652974793787115730529843850",
"296225506779245110663324183583547845945",
"247525118832550877883796831327865675893",
"114456662749571081404388574358336336205",
"185115490653377166836189353545483936967",
"77000548692247690398372964205102610583",
"99483117626020942933126137356360797225",
"261635671113169577453722240038587419640",
"304807185852174070267389122621415573760",
"329215959930682613744660726647261768070",
"138888287435083734030426246052292203848",
"263773158911600292833755830173463900148",
"161263383326868212578787216436768122908",
"31953310932968827380744280373804748750",
"4383283949461574686429789971569790132",
"29377741511115081732447404411056232076",
"157262792342393075779637607692512383676",
"3671492231976648725464010883286359669",
"172778550301741723503682029183123280171",
"217100490491555039525479230601844597164",
"27944693568329853516156300044836079850",
"328504894469726072913740507417407961978",
"247407392727802679723915275625876545634",
"292065861223579211394748247655763349169",
"340262854517073083674566928314618700736",
"187678360942693308071734551182563827747",
"94317295071994426855460071437895997537",
"178493268524043609296186759261968154148",
"228612056693601549983674377641479657494",
"94181301898456477420939306745631414654",
"150112408123944522266178118458701673647",
"206136099976061503837668693244670180392",
"138177259266815212219718954862248133629",
"144300363897483316125032120428849981911",
"20577933696555227874274560387673339735",
"64495372871077041874547315889363705430",
"148786167739944880445760954499620825304",
"100919950167921482913213618160693580377",
"292065861223579211394748247655763349169",
"109388128052665260361439665827095668367",
"41144228722413118389381216851644387661",
"73544478496012209991548760381201271277",
"93780696379608648434661138669345997366",
"282872931650054470046947792897709265878",
"318541094847922687902302891062167062864",
"179311021945487843882377444412728226380",
"76917635038855133274308910536600472167",
"310694464967232458356714176730730489168",
"296686883276443509584237146630190795672",
"255872463035991752878277085624323242446",
"17984542473947144528061290254524488768",
"35719812631827448927457797157170754955",
"226520233599777005883376686346749716974",
"98967759969106820890500254592531640925",
"76861190001115234234930627338078994595",
"331681277104604549654900151500287181545",
"6437698559976952217189936292062593318",
"312581831076539168183617217384751299863",
"21852982271249214521543871929735244652",
"58597282214664081527139314784845929007",
"124245543578429369214053573232525401745",
"62679103246636201350101919336608905304",
"19165813031192502550126622899529578152",
"176303257230598413776602610141272894157",
"326770925061926610677869150437838518228",
"140290336296438497308255305361419505582",
"45613540390725313193441876752628077343",
"203152473456846459380438535926625798908",
"268138702120761752837403084638435145758",
"163777960762682135209613745284498597103",
"120712578200357072505941374885675303495",
"289256701781051190621298349388533263006",
"108930257769054412114390896392410664755",
"288728475647171968337520082454529337251",
"213988328744853997507410940010911697764",
"234898991498411539593199145067611871135",
"327965080741840963665010996578271695211",
"191111600436952155581210321626626306764",
"167222415381481490516268501663781671710",
"293699859878814176248874928315787029167",
"92270874924179053994784090238066499332",
"18598215012545828530898323087765005573",
"309282633617719674490794443962910602883",
"323351510279151634275639100330930099322",
"75019966051400470410968109620178008103",
"161779190388306280327261460338209774511",
"146417959943738986346856697323016304306",
"92270874924179053994784090238066499332",
"32187710215938380114209738092520426948",
"238951762504793758226416952118809272158",
"249511020972587716140178698489980387261",
"224852686934264537651582106523921228087",
"296401233229545883552914322201922527716",
"27345914941363503538692563840617551778",
"36174006513573092572769438937778132589",
"146125283567961435638524324993284836995",
"284245599411164758222685493512387917109",
"90942171927126273469068085434724456268",
"125035722018866071339977198830307485001",
"288602019173766532868488370771878262955",
"316219238231744460251859767383938239295",
"314844393196368739717207419241812953189",
"16782869112545349418513811231983083742",
"91152557064941867468095627472479712911",
"298423424483504459409652907764851587802",
"189943426694771177075309092254170013115",
"59490183775988542349704479501508679057",
"72022792362068198400943978295238048837",
"271518683039425827066713366833428521528",
"78818124313604943298620532033816356365",
"252021446839517083039827438257749015102",
"321741635467283723599569756007248331150",
"316987381922303455312026905876634714747",
"1939370041212332446131931846806680374",
"99216519732238544132792124866147928789",
"239517584187642691532039008944411174734",
"19923561374635732164987148552180807573",
"196001851640583876659541510472756421809",
"129298085692428760986144094493569313653",
"180120634939223108920456634490160043285",
"193271170968672822000737073968099719852",
"259310729079967204824383280077149222637",
"201595668394657753133271285282540265312",
"98967759969106820890500254592531640925",
"263934014901908843272935604991024327285",
"308930927462308514452435770420825765386",
"164563539450948347646578040922480971270",
"98310693019717181973490537153301997408",
"65186207819443408281464185488823933628",
"121265951310275951393864937978956216152",
"182950312126127258324832128488880117341",
"84161824097943844707168043137771974741",
"291674030119622102510135207393357726506",
"267723462261926478570253792463834550251",
"197336080206596994642590764204830625529",
"259355233886513889243080450214713417646",
"61237274547529525771852860604573635102",
"67896262984106420351717904157758317110",
"159428635550397897030767650490398849628",
"16937022786061022323567380995753523477",
"236133460178358365395241995360853913527",
"326899720939051209381008726008920347824",
"40000356953025080050404980879377165406",
"314679431098372262416409531042231158509",
"227229674867176805874186672742704782773"
]
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/netrc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-e229e24b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"195807384842032087678108297096174561063",
"240905657747920737776513133038022482107",
"88036451735599377824398881669510432776",
"19793041875625311503098422903825031437",
"265905870690784954298595962042492389874",
"264572834615047979878689417376970602168",
"94141150343951797070923456142801412137",
"201182214037835809888384995304210394205",
"269718940332221660015263513793636101657",
"119494309045852000288953396125051674639",
"61300936414498691915916614170926751586",
"236384026485742010556043450960149173431",
"208555157924623752130203988940340454019",
"269918482311381055185885322768483639501",
"315062261358198903038079032715218482843",
"230154260399830800540299575852659348321",
"305636106950701754509446328314407128576",
"262219829891760951176027350801843422577",
"321518910144824011200376536096772334705",
"139495112934495709503873451624927788567",
"168649691491999603323437137468582825447",
"232915846615375080760978440882898279497",
"337290478616797118524997932559616252052",
"92259662132739646082887336685351570274",
"336525593985974211333934814154479209464",
"137447676030007812446920756557080373858",
"145685591047084940236628882633750317593",
"153167126208786841410353564554028847102",
"62052974061319903222004025693566057443",
"153673189237819218323307998571617258624",
"227299583804890146077392633525575888119",
"305522694687596256243546640546568590459",
"273044645211350846033584871890401335473",
"163365333947463192760216260292028193514",
"301577575608671256612978537209488775350",
"138296329535695243793675123552787308554",
"11173550136650772567686384337138467445",
"337882925651926758648725540668489147369",
"71663122111869503228292106438062112443",
"12272711298634006766117908595968064662",
"254057739783752532600764260309347383501",
"65379581789133695333888987253781950554",
"255772481053139713470761519625210836920",
"11447611125312800329629297829705834268",
"31950707700823684421250214113060770541",
"242878051463742818761030350624737287398",
"176292618095726273547756548976732720744",
"47000282078289236104203150693388878037",
"75080787919516261733111175736122203117",
"23083476652692859764261297538255027298",
"129611878744181692804269826329864196513",
"132793091952932130238074493328709801277",
"122607458717772569004934282165983001461",
"311724413089722538709211833105982776430",
"319434170078881025771316701135735051629",
"89123610357461740797343415169143561032",
"106359182976240519224092315537475955067",
"162240701871942788993198255023431507194",
"50899155247496587040342564872921166855",
"311602170004364589135633052387015936263",
"66017116135917131738000578990917344476",
"177798347105392825602299368301922052331",
"292574856563948377598548595908291316798",
"197859983543083669062811321774633875290",
"140113050783364515693536456784515034485",
"51486105430146453859088449123636429907",
"217032543364218657549416881080637082261",
"152263618567291716726666212423281873377",
"328339559950213226534873388295870788769",
"299288491536361154514916667933499601894",
"44253098051700204547936913683849244588",
"207763944801526387621214977909283839172",
"168630477062318237640660198303798959693",
"1536294927567117269082996418914568367",
"70515947133174249107469129227124063602",
"253961211258744563756819782130400400717",
"97053308401048101453028892494133629282",
"253211115752674679496642242497893116717",
"226179297212893957185202013358978575147",
"196138120906625929915259282849840888599",
"333015297736188623012668399617368855307",
"28541215320575547937847807128317406185",
"29381514840627809569376750085977177944",
"49702140824269539170026474511453447001",
"325243265852223401083033438233536009299",
"303653232254312289783649726094161052194",
"298038182788289642284144550854427571233",
"128744647805083624908710825638047135972",
"120228623402228902031462508200036349190",
"308398636643076697218532495886188137768",
"40962096685872879566016599495241993989",
"89512642602297521256563429117912872529",
"204049306862789424100599685504743788693",
"105552415984217633116929789906162767496",
"259459159133559408356208227046082718522",
"334308175244175367421610182217809446724",
"242580681389917875307763923072335106673",
"63824593030906819376018555020435022740",
"91583871598916800206432275801362512022",
"3291060169524112011611896500799680721"
]
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/url.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8926-e76e3a3f",
"digest": {
"length": 2773,
"function_hash": "70915324647206308559935593232717611442"
},
"source": "https://github.com/curl/curl.git/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854",
"target": {
"file": "lib/url.c",
"function": "override_login"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:05:48Z"
}
}
],
"modified": "2026-10-25T01:05:48.961296766Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-522",
"desc": "Insufficiently Protected Credentials"
},
"URL": "https://curl.se/docs/CVE-2026-8926.json",
"www": "https://curl.se/docs/CVE-2026-8926.html",
"issue": "https://hackerone.com/reports/3735184",
"affects": "both",
"package": "curl",
"severity": "Low",
"last_affected": "8.20.0"
}
},
"related_cves": [
{
"value": "CVE-2026-8926",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444432,
"published_at": "2026-06-24T08:00:00+00:00"
}