CVE-2026-8926: password leak with netrc and user in URL

Hey all, Before the following report, I just want to point to a comment from our scanner, where it seems it was already picked up but it was dismissed and the PR was closed later by another commit - https://github.com/curl/curl/pull/20932#issuecomment-4072903895

Nonetheless, it appears this issue exists for a while, actually since e9b9bbac22c26cf67316fa8e6c6b9e831af31949 (2024-11-15)

Summary:

curl/libcurl can combine a username supplied in the URL with a password from a .netrc entry whose explicit login does not match that username.

For example, if .netrc contains credentials for alice, and the requested URL contains username bob, curl sends an HTTP Basic Authorization header for bob:alice_password.