CVE-2025-14524

Publication date 6 January 2026

Last updated 7 January 2026


Ubuntu priority

Description

When an oauth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Why is this CVE low priority?

This is rated as being low severity by Curl developers

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
curl 25.10 questing
Vulnerable
25.04 plucky
Vulnerable
24.04 LTS noble
Vulnerable
22.04 LTS jammy
Vulnerable
20.04 LTS focal
Vulnerable
18.04 LTS bionic
Vulnerable
16.04 LTS xenial
Vulnerable
14.04 LTS trusty
Vulnerable

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
curl