CVE-2025-14524
Medium · 5.3CVSS
5.3
EPSS
0.7%
Published
Jan 8, 2026
CISA due date
—
The record
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | curl | 0 | 7.88.1-4.9.mga9 |
| openSUSE:Leap 15.6 | curl | 0 | 8.14.1-150600.4.34.1 |
| openSUSE:Leap 16.0 | curl | 0 | 8.14.1-160000.4.1 |
| openSUSE:Tumbleweed | curl | 0 | 8.18.0-1.1 |
Related vulnerabilities
- CVE-2025-15224 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key… Also affects curl
- CVE-2025-15079 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts… Also affects curl
- CVE-2025-14819 When doing TLS related transfers with reused easy or multi handles and altering the… Also affects curl
- CVE-2025-14017 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS… Also affects curl
- CVE-2024-11053 When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl… Also affects curl
- CVE-2024-9681 When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent… Also affects curl
- CVE-2023-46219 When saving HSTS data to an excessively long file name, curl could end up removing all… Also affects curl
- CVE-2023-46218 This flaw allows a malicious HTTP server to set "super cookies" in curl that are then… Also affects curl