Skip to main content

curl CVE-2026-7168

| EUVDEUVD-2026-29932 MEDIUM
Authentication Bypass by Capture-replay (CWE-294)
2026-05-08 GHSA-v92m-hrhj-gw54
Information Disclosure Apple Jenkins Curl Haxx
5.3
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker positions on network between proxies
  2. Delivery
    Observes curl Digest auth request
  3. Exploit
    Captures leaked nonce and auth state
  4. Execution
    Replays credentials to second proxy
  5. Persist
    Bypasses Digest challenge
  6. Impact
    Gains unauthorized access

Vulnerability Assessment

Weakness
CWE
CWE-294
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Replay attack prevention
Exploitation Conditions

The vulnerability requires curl to be configured for use with multiple proxies in a redirect-or-chaining topology (explicitly termed 'redirect-to proxy' in the oss-security advisory). The Digest authentication state leak occurs only when: (1) curl makes requests through at least two proxies in sequence; (2) both proxies (or at least the first and second in the chain) require Digest authentication; (3) curl reuses or incorrectly isolates the authentication state between the two proxy connections; (4) the attacker can observe or intercept HTTP traffic between these proxies. Single-proxy deployments with Digest authentication are NOT affected. Default curl configurations with a single proxy or direct HTTP connections are NOT vulnerable. The attack requires network-level access between proxies, not necessarily authentication to any service.
Impact

The risk assessment reveals a disconnect between formal CVSS metrics and real-world exploitability. CVSS 5.3 with AV:N/AC:L/PR:N/UI:N/S:U/C:L indicates network-accessible information disclosure requiring no authentication or user interaction-formally a moderate-severity issue. However, EPSS score of 0.03% (10th percentile) suggests this vulnerability has negligible exploitation probability in observed attack telemetry, indicating either narrow deployment patterns, difficult trigger conditions, or limited attacker interest. No KEV status is provided, meaning no confirmed active exploitation via CISA. The vulnerability requires a specific multi-proxy deployment topology (redirect-to-proxy scenario per oss-security disclosure) to trigger, which significantly reduces the attack surface compared to single-proxy or direct HTTP scenarios. The information disclosure is limited to authentication credentials used in that specific request chain, not session-wide data. Defenders should prioritize patch application for internet-facing proxy-dependent applications but can deprioritize in single-proxy or direct-connection deployments.
Exploit ScenarioDerived

An attacker positioned to observe HTTP traffic between curl and an intermediate proxy (e.g., on a shared corporate network) crafts multiple requests through sequential proxies requiring Digest authentication. curl's leaked Digest nonce and authentication state from the first proxy-to-proxy hop can be intercepted and replayed to the second proxy, bypassing Digest challenge-response requirements. If the proxies share authentication realms or the attacker controls both endpoints, the leaked credentials enable unauthorized access to downstream resources.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 13, 2026

Cross-proxy Digest authentication state leak in curl allows remote attackers to obtain sensitive authentication credentials when curl is used with proxy authentication across multiple proxy hops. The vulnerability affects curl versions from 7.12.0 through 8.19.0 due to improper handling of Digest authentication state between proxies, enabling credential disclosure with network-level access and no authentication requirements. EPSS score of 0.03% suggests low real-world exploitation probability despite the information disclosure impact.

RemediationAI

Upgrade curl to the first patched version released after the coordinated disclosure on April 29, 2026. As exact patched version numbers are not provided in the input data, consult curl's official advisory at https://curl.se/docs/CVE-2026-7168.html for the specific fixed version. For immediate mitigation in multi-proxy environments, disable proxy chaining and use direct proxy connections where operationally feasible, or implement proxy authentication at only the final proxy hop rather than intermediate hops. If proxy chaining is mandatory, isolate Digest authentication sessions by adding request-level nonce invalidation or by forcing HTTP Basic authentication (if acceptable security-wise) as an alternative, though this requires careful evaluation of the security trade-off. Monitor curl release notes and apply patches promptly, as the multi-proxy scenario is increasingly common in enterprise environments using HTTP-to-HTTPS bridging or multi-tier proxy architectures.

Affected VersionsENISA

curl 7.74.0 ≤7.74.0
curl 7.23.0 ≤7.23.0
curl 7.52.1 ≤7.52.1
curl 7.21.5 ≤7.21.5
curl 7.15.3 ≤7.15.3
curl 7.41.0 ≤7.41.0
curl 7.12.0 ≤7.12.0
curl 7.22.0 ≤7.22.0
curl 7.18.0 ≤7.18.0
curl 7.18.2 ≤7.18.2
curl 7.64.0 ≤7.64.0
curl 7.73.0 ≤7.73.0
curl 7.77.0 ≤7.77.0
curl 7.70.0 ≤7.70.0
curl 7.26.0 ≤7.26.0
curl 7.21.6 ≤7.21.6
curl 7.16.2 ≤7.16.2
curl 7.42.0 ≤7.42.0
curl 7.23.1 ≤7.23.1
curl 8.2.0 ≤8.2.0
curl 8.4.0 ≤8.4.0
curl 7.69.1 ≤7.69.1
curl 8.17.0 ≤8.17.0
curl 7.19.5 ≤7.19.5
curl 7.37.0 ≤7.37.0
curl 8.10.0 ≤8.10.0
curl 8.1.2 ≤8.1.2
curl 7.18.1 ≤7.18.1
curl 7.13.0 ≤7.13.0
curl 7.37.1 ≤7.37.1
curl 7.54.1 ≤7.54.1
curl 7.19.2 ≤7.19.2
curl 8.12.1 ≤8.12.1
curl 7.35.0 ≤7.35.0
curl 8.1.0 ≤8.1.0
curl 7.17.1 ≤7.17.1
curl 8.9.0 ≤8.9.0
curl 7.28.1 ≤7.28.1
curl 7.17.0 ≤7.17.0
curl 7.19.4 ≤7.19.4
curl 7.24.0 ≤7.24.0
curl 7.67.0 ≤7.67.0
curl 7.20.0 ≤7.20.0
curl 7.16.1 ≤7.16.1
curl 7.63.0 ≤7.63.0
curl 7.69.0 ≤7.69.0
curl 7.15.2 ≤7.15.2
curl 7.55.0 ≤7.55.0
curl 7.46.0 ≤7.46.0
curl 7.12.2 ≤7.12.2
curl 7.78.0 ≤7.78.0
curl 7.88.0 ≤7.88.0
curl 7.53.0 ≤7.53.0
curl 8.10.1 ≤8.10.1
curl 7.20.1 ≤7.20.1
curl 7.56.1 ≤7.56.1
curl 8.1.1 ≤8.1.1
curl 7.47.1 ≤7.47.1
curl 7.30.0 ≤7.30.0
curl 7.33.0 ≤7.33.0
curl 7.21.7 ≤7.21.7
curl 8.2.1 ≤8.2.1
curl 7.32.0 ≤7.32.0
curl 7.61.0 ≤7.61.0
curl 7.45.0 ≤7.45.0
curl 7.72.0 ≤7.72.0
curl 7.21.2 ≤7.21.2
curl 8.5.0 ≤8.5.0
curl 7.15.4 ≤7.15.4
curl 7.43.0 ≤7.43.0
curl 7.58.0 ≤7.58.0
curl 7.19.6 ≤7.19.6
curl 7.28.0 ≤7.28.0
curl 7.50.1 ≤7.50.1
curl 7.42.1 ≤7.42.1
curl 7.65.2 ≤7.65.2
curl 7.87.0 ≤7.87.0
curl 7.34.0 ≤7.34.0
curl 7.76.0 ≤7.76.0
curl 8.11.0 ≤8.11.0
curl 7.51.0 ≤7.51.0
curl 7.16.0 ≤7.16.0
curl 7.56.0 ≤7.56.0
curl 8.14.1 ≤8.14.1
curl 8.14.0 ≤8.14.0
curl 7.85.0 ≤7.85.0
curl 7.66.0 ≤7.66.0
curl 7.79.1 ≤7.79.1
curl 7.13.1 ≤7.13.1
curl 7.59.0 ≤7.59.0
curl 7.49.1 ≤7.49.1
curl 7.57.0 ≤7.57.0
curl 7.47.0 ≤7.47.0
curl 7.71.0 ≤7.71.0
curl 8.9.1 ≤8.9.1
curl 7.50.2 ≤7.50.2
curl 7.68.0 ≤7.68.0
curl 7.49.0 ≤7.49.0
curl 8.7.0 ≤8.7.0
curl 7.76.1 ≤7.76.1
curl 7.86.0 ≤7.86.0
curl 7.15.5 ≤7.15.5
curl 8.11.1 ≤8.11.1
curl 7.62.0 ≤7.62.0
curl 7.14.0 ≤7.14.0
curl 7.64.1 ≤7.64.1
curl 7.50.3 ≤7.50.3
curl 7.21.4 ≤7.21.4
curl 7.71.1 ≤7.71.1
curl 7.27.0 ≤7.27.0
curl 7.55.1 ≤7.55.1
curl 7.60.0 ≤7.60.0
curl 7.12.1 ≤7.12.1
curl 8.7.1 ≤8.7.1
curl 7.25.0 ≤7.25.0
curl 7.83.1 ≤7.83.1
curl 7.61.1 ≤7.61.1
curl 7.12.3 ≤7.12.3
curl 7.19.7 ≤7.19.7
curl 8.12.0 ≤8.12.0
curl 7.40.0 ≤7.40.0
curl 7.16.4 ≤7.16.4
curl 7.83.0 ≤7.83.0
curl 7.53.1 ≤7.53.1
curl 7.50.0 ≤7.50.0
curl 8.15.0 ≤8.15.0
curl 7.82.0 ≤7.82.0
curl 7.88.1 ≤7.88.1
curl 8.3.0 ≤8.3.0
curl 7.44.0 ≤7.44.0
curl 7.19.3 ≤7.19.3
curl 7.29.0 ≤7.29.0
curl 7.15.1 ≤7.15.1
curl 7.21.1 ≤7.21.1
curl 8.0.0 ≤8.0.0
curl 7.75.0 ≤7.75.0
curl 7.21.0 ≤7.21.0
curl 7.48.0 ≤7.48.0
curl 7.13.2 ≤7.13.2
curl 7.39.0 ≤7.39.0
curl 7.54.0 ≤7.54.0
curl 7.52.0 ≤7.52.0
curl 8.0.1 ≤8.0.1
curl 7.84.0 ≤7.84.0
curl 7.80.0 ≤7.80.0
curl 7.19.0 ≤7.19.0
curl 8.19.0 ≤8.19.0
curl 7.19.1 ≤7.19.1
curl 7.65.3 ≤7.65.3
curl 8.6.0 ≤8.6.0
curl 7.16.3 ≤7.16.3
curl 7.65.1 ≤7.65.1
curl 7.15.0 ≤7.15.0
curl 7.14.1 ≤7.14.1
curl 7.81.0 ≤7.81.0
curl 7.31.0 ≤7.31.0
curl 8.18.0 ≤8.18.0
curl 8.8.0 ≤8.8.0
curl 8.13.0 ≤8.13.0
curl 7.36.0 ≤7.36.0
curl 7.65.0 ≤7.65.0
curl 7.79.0 ≤7.79.0
curl 7.21.3 ≤7.21.3
curl 7.38.0 ≤7.38.0
curl 8.16.0 ≤8.16.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

curl's HTTP client library implements Digest authentication (RFC 2617), which requires stateful management of nonce values and authentication state across multiple requests. When curl routes requests through multiple proxies (proxy chaining), the authentication state-particularly the Digest nonce and related cryptographic material-may persist incorrectly across different proxy connections. The vulnerability stems from improper isolation or reuse of Digest auth context when switching between proxy endpoints. CWE classification is not specified in the input data, but the mechanism aligns with CWE-384 (Session Fixation) or CWE-613 (Insufficient Session Expiration), where authentication credentials leak between security boundaries.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat 5.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

3
CVSS changed
May 13, 2026 - 16:22 NVD
5.3 (MEDIUM)
CVE Published
May 08, 2026 - 06:45 nvd
UNKNOWN (no severity yet)
CVE Published
May 08, 2026 - 06:45 nvd
MEDIUM 5.3

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Threat Intelligence Overview

EPSS Score
0.0%
Top 90% exploitable
Social Media
4
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-294 – Authentication Bypass by Capture-replay

View all
CVE-2017-3191 CRITICAL
9.8
CVE-2026-62911 HIGH POC
8.0
CVE-2017-6823 HIGH POC
8.8
CVE-2023-1886 CRITICAL POC
9.8
CVE-2023-1537 CRITICAL POC
9.8
CVE-2022-29334 CRITICAL POC
9.8
CVE-2021-27289 CRITICAL POC
9.1
CVE-2022-31277 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed
SLES15-SP6-CHOST-BYOS-GCE Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:19106 ADVISORY https://curl.se/docs/CVE-2026-7168.html ADVISORY https://curl.se/docs/CVE-2026-7168.json ADVISORY https://hackerone.com/reports/3697719 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-7168 ADVISORY https://ubuntu.com/security/notices/USN-8525-1 ADVISORY https://vuldb.com/vuln/360240 ADVISORY https://www.openwall.com/lists/oss-security/2026/04/29 REF http://www.openwall.com/lists/oss-security/2026/04/29/14

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy