GHSA-gj6x-q8rh-wj6x
NoneCVSS
—
EPSS
—
Published
Feb 26, 2026
CISA due date
—
The record
Curio exposes database credentials to users with network access through verbose HTTP error responses
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/filecoin-project/curio | 1.24.3 | 1.27.3-rc2 |
Related vulnerabilities
- CVE-2026-92936 vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code… CWE-209
- CVE-2026-11873 An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests)… CWE-209
- CVE-2026-82739 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
- CVE-2026-82733 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
- CVE-2026-77950 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
- CVE-2026-82727 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
- CVE-2026-82580 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
- CVE-2026-75760 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209