CVE-2025-14524

EUVD-2026-1582
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer
performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,
POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new
target host.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CISA-ADPADP
5.3 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
Affected Products (NVD)
VendorProductVersion
haxxcurl
7.33.0 ≤
𝑥
< 8.18.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
curl
bookworm
no-dsa
bookworm (security)
vulnerable
bullseye
postponed
bullseye (security)
vulnerable
forky
8.18.0-2
fixed
sid
8.19.0~rc2-2
fixed
trixie
no-dsa
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://curl.se/docs/CVE-2025-14524.html
https://curl.se/docs/CVE-2025-14524.json
https://hackerone.com/reports/3459417
http://www.openwall.com/lists/oss-security/2026/01/07/4