CVE-2026-94266

None

CVSS

—

EPSS

0.3%

Published

Oct 20, 2026

CISA due date

—

The record

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

Affected packages

Ecosystem	Package	Introduced	Fixed