DEBIAN-CVE-2026-94266 - curl/curl
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
CWE-522
Evidence
- upstream fix 7a6bd027 present in fork base
- regression test tests/data/test5032 executed RED then GREEN
History
- 2026-10-28: in-progress - fix agent dispatched
- 2026-10-28: fork-fixed - merged to fork master a33880b