ZeroDay Findings
Sign inSign up

Findings

CVE-2021-22876

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header.

Published Apr 1, 2021 · updated Oct 14, 2026 · haxx libcurl

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 1, 2021 · NIST NVD

    Detected

    curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the tar

  2. Oct 14, 2026 · NIST NVD

    Updated

    curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the tar

Affected

  • cpe broadcom/fabric operating systemversion unspecified
  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora32
  • cpe fedoraproject/fedora33
  • cpe fedoraproject/fedora34
  • cpe haxx/libcurlversion unspecified
  • cpe netapp/hci compute nodeversion unspecified
  • cpe netapp/hci management nodeversion unspecified
  • cpe netapp/hci storage nodeversion unspecified
  • cpe netapp/solidfireversion unspecified
  • cpe oracle/communications billing and revenue management12.0.0.3.0
  • cpe siemens/sinec infrastructure network servicesversion unspecified

Sources

  • CVE.orgCVE-2021-22876

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2021-22876

    curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP

    nvd.nist.gov

References