CVE detail
CVE-2025-0167
When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 16.1 · diversity 11.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
4 source links · newest first
- https://security.netapp.com/advisory/ntap-20250306-0008/security.netapp.com
No excerpt available.
Vendor Advisorysecurity.netapp.comFeb 5, 2025, 10:15 AM - https://hackerone.com/reports/2917232hackerone.com
No excerpt available.
Exploithackerone.comFeb 5, 2025, 10:15 AM No excerpt available.
Vendor Advisorycurl.seFeb 5, 2025, 10:15 AMNo excerpt available.
Vendor Advisorycurl.seFeb 5, 2025, 10:15 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2024-6119CVSS 7.5 · High
Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal…
- CVE-2024-11053CVSS 3.4 · Low
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain cir…
- CVE-2024-2398CVSS 8.6 · High
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts…
- CVE-2024-2379CVSS 6.3 · Medium
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path…
- CVE-2021-3772CVSS 6.5 · Medium
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port…
- CVE-2024-33601CVSS 7.3 · High
nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may term…