CVE-2026-6429Patch(haxx / curl)

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch haxx curl systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

haxx CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://curl.se/docs/CVE-2026-6429.html

Exploit / PoC references

https://hackerone.com/reports/3677759

Other references

https://curl.se/docs/CVE-2026-6429.json

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

curl

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 2 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 2d ago at 2 mentions (2026-04-30); latest day: 2
6 total mentions across 4 days

Affected systems

Vendors

haxx

Products

curl

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Patch

350.0%

General

233.3%

Disclosure

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-29	1	General1
2026-04-30	2	General1Patch1
2026-05-02	1	Disclosure1
2026-05-11	2	Patch2

Full discourse6 posts

Open Source Security mailing list@oss_security161d
Patch
8 CVEs fixed in curl https://www.openwall.com/lists/oss-security/2026/04/29/ CVE-2026-4873: connection reuse ignores TLS requirement CVE-2026-5545: wrong reuse of HTTP Negotiate connection CVE-2026-5773: wrong reuse of SMB connection CVE-2026-6429: netrc credential leak with reused proxy connection 1/2
Post summary
The advisory announces that eight CVEs in curl have been fixed, gives concise technical details for each, and highlights that patches are available, with no indications of active exploitation or PoC evidence.
12070495
4.7K followersView on X
草薙沙耶(KUSANAGI)@kusanagi_saya150d
Patch
kusanagi-curl モジュール更新情報 8.20.0-1 https://kusanagi.tokyo/releases/24476/ KUSANAGI 9 を構成している各モジュールのアップデートを行いました。アップデートにより適用される各モジュールのバージョンは、以下のとおりとなります。 curl 8.20.0-1 この更新には脆弱性(CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, CVE-2026-6253, CVE-2026-5773, CVE-2026-5545, CVE-2...
Post summary
The kusanagi-curl module update to 8.20.0‑1 patches several CVEs (e.g., CVE‑2026‑7168, CVE‑2026‑7009), offering a fix for KUSANAGI 9 components.
0101085
200 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds162d
General
CVE-2026-6429 [ADVISORY] curl https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6429
Post summary
A brief advisory for CVE-2026‑6429 affecting curl is listed, with a link to a details page but lacking technical or remedial information.
0000143
4.0K followersView on X
草薙沙耶(KUSANAGI)@kusanagi_saya150d
Patch
kusanagi-curl Module Update 8.20.0-1 https://kusanagi.tokyo/en/releases/24477/ KUSANAGI 9 modules have been updated. The updated modules are as follows: curl 8.20.0-1 This update includes support for vulnerability(CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, CVE-2026-6253,...
Post summary
The message announces an update to kusanagi modules that patches multiple CVEs, but provides no exploit details or PoC information.
0000040
200 followersView on X
H1 Disclosed - Public Disclosures@h1Disclosed159d
Disclosure
⚡ CVE-2026-6429: netrc credential leak with reused proxy connection 👨🏻‍💻 nobcoderr ➟ curl 🟧 Medium 💰 None 🔗 https://hackerone.com/reports/3677759 #bugbounty #bugbountytips #cybersecurity #infosec https://t.co/qaBBbgMZw3
Post summary
This tweet discloses CVE-2026-6429, a medium‑severity credential‑leak issue involving reused proxy connections, with no evidence of active exploitation, patch, or PoC details.
00000552
10.2K followersView on X
Autumn Good@autumn_good_35160d
General
curlで8件の脆弱性 CVE-2026-7168 CVE-2026-7009 CVE-2026-6429 CVE-2026-6276 CVE-2026-6253 CVE-2026-5773 CVE-2026-5545 CVE-2026-4873 Published vulnerabilities for curl/libcurl https://curl.se/docs/security.html
Post summary
The text lists eight CVE identifiers for curl along with a link to curl’s security page but provides no additional detail, evidence of exploitation, or mitigation information.
00000396
6.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	haxx	curl	-	-	-

Explore more

Back to dashboard haxx CVEs curl vulnerabilities

What researchers are saying

CVE-2026-6429

Open Source Security mailing list@oss_securityPatch

The advisory announces that eight CVEs in curl have been fixed, gives concise technical details for each, and highlights that patches are available, with no indications of active exploitation or PoC evidence.

草薙沙耶(KUSANAGI)@kusanagi_sayaPatch

The kusanagi-curl module update to 8.20.0‑1 patches several CVEs (e.g., CVE‑2026‑7168, CVE‑2026‑7009), offering a fix for KUSANAGI 9 components.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

A brief advisory for CVE-2026‑6429 affecting curl is listed, with a link to a details page but lacking technical or remedial information.

草薙沙耶(KUSANAGI)@kusanagi_sayaPatch

The message announces an update to kusanagi modules that patches multiple CVEs, but provides no exploit details or PoC information.

H1 Disclosed - Public Disclosures@h1DisclosedDisclosure

This tweet discloses CVE-2026-6429, a medium‑severity credential‑leak issue involving reused proxy connections, with no evidence of active exploitation, patch, or PoC details.

Autumn Good@autumn_good_35General

The text lists eight CVE identifiers for curl along with a link to curl’s security page but provides no additional detail, evidence of exploitation, or mitigation information.