It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1351 advisory.

    When asked to both use a `.netrc` file for credentials and to follow HTTPredirects, curl could leak the     password used for the first host to thefollowed-to host under certain circumstances.

    This flaw only manifests itself if the netrc file has an entry that matchesthe redirect target hostname     but the entry either omits just the password oromits both login and password. (CVE-2024-11053)

    When asked to use a `.netrc` file for credentials **and** to follow HTTPredirects, curl could leak the     password used for the first host to thefollowed-to host under certain circumstances.

    This flaw only manifests itself if the netrc file has a `default` entry thatomits both login and password.
    A rare circumstance. (CVE-2025-0167)

    predictable WebSocket mask

    NOTE: https://curl.se/docs/CVE-2025-10148.htmlNOTE: Fixed by:
    https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa7fa806fa0f2 (curl-8_16_0)     (CVE-2025-10148)

    curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed     and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more. (CVE-2025-10966)

    Out of bounds read for cookie path

    NOTE: https://curl.se/docs/CVE-2025-9086.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/f24dc09d209a2f91ca38d854f0c15ad93f3d7e2d (curl-7_31_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb62b45dd37711300 (rc-8_16_0-1) (CVE-2025-9086)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2025-1351)

medium Nessus Plugin ID 282370

Version 1.2

Version 1.1

Version 1.2 Jan 21, 2026, 5:00 PM IAVM reference Plugin Feed: 202601211700
Version 1.1 Jan 8, 2026, 1:54 PM New Plugin Feed: 202601081354