CVE-2025-14524

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

• curl 8.18.0~rc2-1 [trixie] - curl 8.14.1-2+deb13u4 [bookworm] - curl 7.88.1-10+deb12u15 [bullseye] - curl (Minor issue; can be fixed in next update) https://curl.se/docs/CVE-2025-14524.html Introduced with: https://github.com/curl/curl/commit/06c1bea72faabb6fad4b7ef818aafaa336c9a7aa (curl-7_33_0) Fixed by: https://github.com/curl/curl/commit/1a822275d333dc6da6043497160fd04c8fa48640 (rc-8_18_0-2, curl-8_18_0)