CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2026-3783

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.

Score
5.3 medium
Published
2026-03-11
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
ftp/linux-rl9-curllinux-rl9-curl7.76.1_13unaddressedemulation@FreeBSD.org

VuXML

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-rl9-curl</name>
	<range><lt>8.19.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When an OAuth2 bearer token is used for an HTTP(S) transfer, and that
	transfer
performs a redirect to a second URL, curl could leak that
	token to the second
hostname under some circumstances.

If the
	hostname that the first request is redirected to has information in
	the
used .netrc file, with either of the `machine` or `default`
	keywords, curl
would pass on the bearer token set for the first host
	also to the second one.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-3783</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-3783</url>
    </references>
    <dates>
      <discovery>2026-03-11</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>