CVE-2025-14524 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3…
Medium CVSS: 5.3

CVE-2025-14524

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer
performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,
POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new
target host.
Vendor
Haxx
Product
Curl
CWE
CWE-601
Yayın Tarihi
2026-01-08 10:15:46
Güncelleme
2026-01-20 14:53:11
Source Identifier
2499f714-1537-4658-8207-48ae4bb9eae9
KEV Date Added
-

Kategoriler

CWE-601 Curl MEDIUM Haxx 2026

Referanslar

https://curl.se/docs/CVE-2025-14524.html https://curl.se/docs/CVE-2025-14524.json https://hackerone.com/reports/3459417 http://www.openwall.com/lists/oss-security/2026/01/07/4