---
schema_version: '1.0'
id: security-20260705-abfd66
url: https://osv.dev/vulnerability/CURL-CVE-2024-11053
url_hash: abfd666a1b5294208db8fbaa736d120ef60d8af378e35df66f858739e8c99296
canonical_url: https://osv.dev/vulnerability/CURL-CVE-2024-11053
source: osv:osv
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2024-11053
- CURL-CVE-2024-11053
- severity:Low
- https://github.com/curl/curl
- GIT
lang: en
published_at: '2024-12-11T08:00:00Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-05T15:37:03Z'
status: published
content_hash: 5de3bdd3c103daa0f8662d466038da09e739fcda9218527993c4524465e40e46
license_note: full
summary: netrc and redirect credential leak
summary_source: rss
summary_en: netrc and redirect credential leak
entities:
- name: GitHub
  type: organization
- name: Andal_ucía
  type: UNKNOWN
key_facts: []
related: []
related_auto:
- name: Anonymous
  type: organization
  weight: 1.0
- name: AirPods
  type: artifact
  weight: 1.0
- name: Claude Code
  type: artifact
  weight: 1.0
- name: セッション漏洩
  type: event
  weight: 1.0
- name: local-llm
  type: content
  weight: 1.0
title: 'CVE-2024-11053: netrc and redirect credential leak'
---

# CVE-2024-11053: netrc and redirect credential leak

## TL;DR
netrc and redirect credential leak

## Key Points
- cve / CVE-2024-11053 / CURL-CVE-2024-11053 / severity:Low / https://github.com/curl/curl / GIT

## Details
**Severity:** Low
**Advisory:** CURL-CVE-2024-11053 (CVE-2024-11053)

**Affected (your watchlist):**
- `GIT:https://github.com/curl/curl` curl-8_9_1 → no fixed version listed [mac]

**Details:**
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has an entry that matches
the redirect target hostname but the entry either omits only the password or
omits both login and password.

_Data: OSV.dev (upstream: osv) — https://osv.dev/vulnerability/CURL-CVE-2024-11053_

## Source
元記事: [CVE-2024-11053: netrc and redirect credential leak](https://osv.dev/vulnerability/CURL-CVE-2024-11053) — published 2024-12-11T08:00:00Z