---
schema_version: '1.0'
id: security-20260705-af56d3
url: https://osv.dev/vulnerability/CVE-2024-11053
url_hash: af56d3c35dc82b30838ce7a1e8fb15e699ac92321ba49659815931deda1372ec
canonical_url: https://osv.dev/vulnerability/CVE-2024-11053
source: osv:nvd
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2024-11053
- severity:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
- https://github.com/curl/curl
- GIT
lang: en
published_at: '2024-12-11T08:15:05Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-08T15:37:32Z'
status: published
content_hash: 97bbb1693e76ef1460c9065f57ce1986483260b7e55ecb2506f1c8a9df784edf
license_note: full
summary: netrc and redirect credential leak
summary_source: rss
summary_en: netrc and redirect credential leak
entities:
- name: CVE-2013-0074
  type: naturalobject
- name: GitHub
  type: organization
- name: Andalucía
  type: location
- name: earlyappleleaks
  type: person
related_auto:
- name: agent_openclaw
  type: person
  weight: 1.0
- name: CVSS score
  type: concept
  weight: 1.0
- name: AI Agent
  type: artifact
  weight: 1.0
- name: Hy3
  type: artifact
  weight: 1.0
- name: OpenClaw
  type: artifact
  weight: 1.0
title: CVE-2024-11053 — https://github.com/curl/curl
---

# CVE-2024-11053: netrc and redirect credential leak

## TL;DR
netrc and redirect credential leak

## Key Points
- cve / CVE-2024-11053 / severity:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N / https://github.com/curl/curl / GIT

## Details
**Severity:** CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
**Advisory:** CVE-2024-11053

**Affected (your watchlist):**
- `GIT:https://github.com/curl/curl` curl-8_9_1 → no fixed version listed [mac]

**Details:**
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has an entry that matches
the redirect target hostname but the entry either omits just the password or
omits both login and password.

**References:**
- http://www.openwall.com/lists/oss-security/2024/12/11/1
- https://curl.se/docs/CVE-2024-11053.html
- https://curl.se/docs/CVE-2024-11053.json
- https://hackerone.com/reports/2829063
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11053.json
- https://nvd.nist.gov/vuln/detail/CVE-2024-11053
- https://security.netapp.com/advisory/ntap-20250124-0012/
- https://security.netapp.com/advisory/ntap-20250131-0003/
- https://security.netapp.com/advisory/ntap-20250131-0004/

_Data: OSV.dev (upstream: nvd) — https://osv.dev/vulnerability/CVE-2024-11053_

## Source
元記事: [CVE-2024-11053: netrc and redirect credential leak](https://osv.dev/vulnerability/CVE-2024-11053) — published 2024-12-11T08:15:05Z