{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/rhel7els/vex/2026/cve-2026-6429-els_os-rhel7els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-07-28T15:52:12Z",
      "generator": {
        "date": "2026-07-28T15:52:12Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-6429-ELS_OS-RHEL7ELS",
      "initial_release_date": "2026-05-13T13:01:00Z",
      "revision_history": [
        {
          "date": "2026-05-13T13:01:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-28T15:52:12Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-6429"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 7",
                "product": {
                  "name": "Red Hat Enterprise Linux 7",
                  "product_id": "Red-Hat-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:redhat:enterprise_linux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.29.0-59.0.3.el7_9.2.x86_64",
                "product": {
                  "name": "curl-0:7.29.0-59.0.3.el7_9.2.x86_64",
                  "product_id": "curl-0:7.29.0-59.0.3.el7_9.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.29.0-59.0.3.el7_9.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64",
                "product": {
                  "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64",
                  "product_id": "libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.29.0-59.0.3.el7_9.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64",
                "product": {
                  "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64",
                  "product_id": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.29.0-59.0.3.el7_9.2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.i686",
                "product": {
                  "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.i686",
                  "product_id": "libcurl-0:7.29.0-59.0.3.el7_9.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.29.0-59.0.3.el7_9.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686",
                "product": {
                  "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686",
                  "product_id": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.29.0-59.0.3.el7_9.2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          }
        ],
        "category": "vendor",
        "name": "Red Hat, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
                "product": {
                  "name": "curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
                  "product_id": "curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/curl@7.29.0-59.0.3.el7_9.2.tuxcare.els2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
                "product": {
                  "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
                  "product_id": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/libcurl@7.29.0-59.0.3.el7_9.2.tuxcare.els2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
                "product": {
                  "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
                  "product_id": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/libcurl-devel@7.29.0-59.0.3.el7_9.2.tuxcare.els2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
                "product": {
                  "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
                  "product_id": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/libcurl@7.29.0-59.0.3.el7_9.2.tuxcare.els2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
                "product": {
                  "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
                  "product_id": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/libcurl-devel@7.29.0-59.0.3.el7_9.2.tuxcare.els2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64 as a component of Red Hat Enterprise Linux 7",
          "product_id": "Red-Hat-7:curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64"
        },
        "product_reference": "curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
        "relates_to_product_reference": "Red-Hat-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.29.0-59.0.3.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux 7",
          "product_id": "Red-Hat-7:curl-0:7.29.0-59.0.3.el7_9.2.x86_64"
        },
        "product_reference": "curl-0:7.29.0-59.0.3.el7_9.2.x86_64",
        "relates_to_product_reference": "Red-Hat-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686 as a component of Red Hat Enterprise Linux 7",
          "product_id": "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686"
        },
        "product_reference": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
        "relates_to_product_reference": "Red-Hat-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.i686 as a component of Red Hat Enterprise Linux 7",
          "product_id": "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.i686"
        },
        "product_reference": "libcurl-0:7.29.0-59.0.3.el7_9.2.i686",
        "relates_to_product_reference": "Red-Hat-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64 as a component of Red Hat Enterprise Linux 7",
          "product_id": "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64"
        },
        "product_reference": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
        "relates_to_product_reference": "Red-Hat-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux 7",
          "product_id": "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64"
        },
        "product_reference": "libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64",
        "relates_to_product_reference": "Red-Hat-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64 as a component of Red Hat Enterprise Linux 7",
          "product_id": "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64"
        },
        "product_reference": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
        "relates_to_product_reference": "Red-Hat-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux 7",
          "product_id": "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64"
        },
        "product_reference": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64",
        "relates_to_product_reference": "Red-Hat-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686 as a component of Red Hat Enterprise Linux 7",
          "product_id": "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686"
        },
        "product_reference": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
        "relates_to_product_reference": "Red-Hat-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686 as a component of Red Hat Enterprise Linux 7",
          "product_id": "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686"
        },
        "product_reference": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686",
        "relates_to_product_reference": "Red-Hat-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-6429",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Red-Hat-7:curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
          "Red-Hat-7:curl-0:7.29.0-59.0.3.el7_9.2.x86_64",
          "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.i686",
          "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
          "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
          "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64",
          "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686",
          "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
          "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
          "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-6429"
        }
      ],
      "release_date": "2026-05-13T13:01:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-07-28T12:01:13.327803Z",
          "details": "Low priority: exploitation requires a very specific, non-default setup—libcurl must be explicitly configured to use .netrc and to follow redirects, both the original and redirected requests must use plain HTTP (not HTTPS), and both must traverse the same HTTP proxy with a reused connection. The curl command-line tool is not affected, and the impact is limited to potential disclosure of a .netrc-stored password to the redirect destination, with no integrity or availability impact. In centrally managed server/VM environments where outbound requests are made to fixed endpoints rather than following redirects from untrusted hosts, practical exploitability is very low, so this can be safely deprioritized.",
          "product_ids": [
            "Red-Hat-7:curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
            "Red-Hat-7:curl-0:7.29.0-59.0.3.el7_9.2.x86_64",
            "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.i686",
            "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
            "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
            "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64",
            "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686",
            "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
            "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
            "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red-Hat-7:curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
            "Red-Hat-7:curl-0:7.29.0-59.0.3.el7_9.2.x86_64",
            "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.i686",
            "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
            "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
            "Red-Hat-7:libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64",
            "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686",
            "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686",
            "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64",
            "Red-Hat-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}