What is GHSA-2pvc-5qw9-h3ph?

GHSA-2pvc-5qw9-h3ph is a security advisory published by GitHub Security Advisories with Medium severity. When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl...

Which CVE IDs does GHSA-2pvc-5qw9-h3ph cover?

GHSA-2pvc-5qw9-h3ph covers the following CVE IDs: CVE-2026-6429. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2pvc-5qw9-h3ph?

GHSA-2pvc-5qw9-h3ph has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-2pvc-5qw9-h3phMediumCVSS 5.3

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl...

Vendor

GitHub Security Advisories

Published

May 14, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-6429 →

📋 Description

When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-6429
https://hackerone.com/reports/3677759
https://curl.se/docs/CVE-2026-6429.html
https://curl.se/docs/CVE-2026-6429.json
https://github.com/advisories/GHSA-2pvc-5qw9-h3ph