CVE-2025-0167
When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.
- CVSS 3.1
- 3.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N - EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-25)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- haxx:curl
- netapp:bootstrap_os
- netapp:element_software
- netapp:h300s_firmware
- netapp:h410c_firmware
- netapp:h410s_firmware
- netapp:h500s_firmware
- netapp:h610c_firmware
- netapp:h610s_firmware
- netapp:h615c_firmware
- netapp:h700s_firmware
- netapp:ontap
- netapp:ontap_select_deploy_administration_utility
- netapp:ontap_tools
- netapp:solidfire_\&_hci_management_node
- netapp:solidfire_\&_hci_storage_node