CVE-2025-14524: Haxx Curl

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Affected products

• Haxx Curl: from 7.33.0, before 8.18.0 (fixed in 8.18.0)

Published 2026-01-08. Last modified 2026-09-15.