CVE-2025-14524
📋 TL;DR
This vulnerability in curl allows OAuth2 bearer tokens to be incorrectly passed during cross-protocol redirects from HTTP(S) to IMAP, LDAP, POP3, or SMTP protocols. Attackers could potentially intercept these tokens if they control the redirect target. Any application using curl with OAuth2 bearer tokens for HTTP transfers is affected.
💻 Affected Systems
- curl
- libcurl
📦 What is this software?
Curl by Haxx
curl is a command-line tool and library for transferring data with URLs. It supports numerous protocols including HTTP, HTTPS, FTP, and more, making it essential for API testing, web scraping, and automated data transfers.
Learn more about Curl →⚠️ Risk & Real-World Impact
Worst Case
Authentication tokens are exposed to malicious servers, potentially leading to unauthorized access to protected resources.
Likely Case
Token leakage to unintended servers during redirects, though exploitation requires specific redirect conditions.
If Mitigated
Minimal impact if proper network segmentation and server validation are in place.
🎯 Exploit Status
Exploitation requires control over redirect target and specific protocol transitions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: curl 8.10.0
Vendor Advisory: https://curl.se/docs/CVE-2025-14524.html
Restart Required: No
Instructions:
1. Update curl to version 8.10.0 or later. 2. For libcurl, recompile applications with updated library. 3. No service restart needed for command-line curl.
🔧 Temporary Workarounds
Disable redirects
allPrevent curl from following redirects entirely
curl --max-redirs 0
Use --oauth2-bearer only for final URL
allAvoid using OAuth2 bearer tokens with URLs that might redirect
🧯 If You Can't Patch
- Implement application-level validation of redirect targets
- Use network controls to prevent redirects to unexpected protocols
🔍 How to Verify
Check if Vulnerable:
Check curl version: if between 8.8.0 and 8.9.0 inclusive, and using OAuth2 bearer tokens with redirects.Check Version:
curl --version | head -1Verify Fix Applied:
Verify curl version is 8.10.0 or later: curl --version📡 Detection & Monitoring
Log Indicators:
- Unexpected protocol transitions in curl logs (HTTP->IMAP, HTTP->LDAP, etc.)
- Failed authentication attempts following redirects
Network Indicators:
- Cross-protocol redirect traffic patterns
- Bearer tokens sent to non-HTTP(S) endpoints
SIEM Query:
source="curl" AND (redirect OR "30" OR "Location:") AND (IMAP OR LDAP OR POP3 OR SMTP)