| Package | Affected versions | Patched versions |
|---|---|---|
| curl | ≥ 7.33.0, < 8.18.0 | 8.18.0 |
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free