CVE-2026-8926

描述

When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

如何修補 CVE-2026-8926

要修補 CVE-2026-8926,請將受影響套件升級到下列已修補版本。

• Alpine/curl—升級至 8.21.0-r0 或更新版本

CVE-2026-8926 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 8.11.1, < 8.21.0-r0

CVSS 分數

參考連結(1)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-8926