CVE-2026-94266 — password leak in CURLINFO_EFFECTIVE_URL

libcurl could accidentally return a URL containing credentials through curl_easy_getinfo()'s CURLINFO_EFFECTIVE_URL option, even though neither the URL provided to libcurl nor the redirected URL contained them.