Skip to main content

libcurl CVE-2026-8927

| EUVDEUVD-2026-41508 CRITICAL
Authentication Bypass by Capture-replay (CWE-294)
2026-06-24 GHSA-jr4f-4564-w3mr
Information Disclosure Curl
Critical
Disputed · 9.1 Vendor
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (CNA) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
5.9 MEDIUM

Passive credential disclosure requiring reused handle, env-var proxy config, and two differing proxies drives AC:H; impact is confidentiality-only, so I:N/A:N and no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Jul 06, 2026 - 18:37 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 06, 2026 - 18:37 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 06, 2026 - 18:22 vuln.today
cvss_changed
CVSS changed
Jul 06, 2026 - 18:22 NVD
9.1 (CRITICAL)
Analysis Generated
Jun 24, 2026 - 18:25 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Proxy credential leakage in libcurl (curl) occurs when a single reused easy handle drives sequential transfers through different environment-variable-configured proxies: after Digest-authenticating to proxyA, libcurl fails to reset the proxy authentication state, so the Proxy-Authorization: header meant for proxyA is resent to proxyB. Any application relying on handle reuse with env-var proxy settings and multiple upstream proxies can disclose proxyA's credentials to an unauthorized proxy operator. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Operate/observe proxyB receiving traffic
Delivery
Victim app reuses libcurl handle across proxies
Exploit
proxyA Digest auth state not cleared
Execution
Proxy-Authorization for proxyA resent to proxyB
Persist
Capture leaked proxy credentials
Impact
Reuse/replay against proxyA
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a specific, concrete configuration: a libcurl easy handle that is REUSED for sequential transfers, proxy selection driven by ENVIRONMENT-VARIABLE proxy configuration (http_proxy/https_proxy and friends), an initial transfer that authenticates to one proxy (proxyA) using Digest proxy authentication, and a subsequent transfer routed through a DIFFERENT proxy (proxyB). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals conflict. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An application (e.g., a scraper or CI job) reuses one libcurl handle and honors env-var proxy settings, first fetching through corporate proxyA with Digest auth, then through a different proxyB. libcurl resends proxyA's `Proxy-Authorization` header to proxyB, whose operator (a malicious or compromised proxy) captures the leaked Digest credentials. …
Remediation Patch available per vendor advisory - upgrade libcurl/curl to the fixed release published by the curl project (see https://curl.se/docs/CVE-2026-8927.html; the exact patched version is not stated in the provided data and should be confirmed against that advisory) and apply your distribution's update, e.g. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory systems using libcurl and identify those configured with environment-variable proxies (HTTP_PROXY, HTTPS_PROXY, etc.) and connection handle reuse patterns. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Curl

View all
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
CVE-2023-27533 HIGH POC
8.8 Mar 30

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
CVE-2025-0665 HIGH POC
7.0 Feb 05

A double-close vulnerability exists in libcurl when tearing down connection channels after threaded name resolution, cau
CVE-2022-27778 HIGH POC
8.1 Jun 02

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2020-8177 HIGH POC
7.8 Dec 14

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead to

Same weakness CWE-294 – Authentication Bypass by Capture-replay

View all
CVE-2017-3191 CRITICAL
9.8
CVE-2017-6823 HIGH POC
8.8
CVE-2023-1886 CRITICAL POC
9.8
CVE-2023-1537 CRITICAL POC
9.8
CVE-2022-29334 CRITICAL POC
9.8
CVE-2021-27289 CRITICAL POC
9.1
CVE-2022-31277 HIGH POC
8.8
CVE-2022-31265 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-8927 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy