Skip to main content

libcurl CVE-2026-8927

| EUVDEUVD-2026-41508 CRITICAL
Authentication Bypass by Capture-replay (CWE-294)
2026-06-24 GHSA-jr4f-4564-w3mr
Information Disclosure Curl Haxx
Critical
Disputed · 9.1 Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Operate/observe proxyB receiving traffic
  2. Delivery
    Victim app reuses libcurl handle across proxies
  3. Exploit
    proxyA Digest auth state not cleared
  4. Execution
    Proxy-Authorization for proxyA resent to proxyB
  5. Persist
    Capture leaked proxy credentials
  6. Impact
    Reuse/replay against proxyA

Vulnerability Assessment

Weakness
CWE
CWE-294
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Replay attack prevention
Exploitation Conditions

Exploitation requires a specific, concrete configuration: a libcurl easy handle that is REUSED for sequential transfers, proxy selection driven by ENVIRONMENT-VARIABLE proxy configuration (http_proxy/https_proxy and friends), an initial transfer that authenticates to one proxy (proxyA) using Digest proxy authentication, and a subsequent transfer routed through a DIFFERENT proxy (proxyB). The leak recipient must be able to observe proxyB's inbound headers (i.e., control or monitor proxyB). Limiting factors: it does not affect single-proxy deployments, does not affect applications that create a fresh handle per request, and requires two distinct proxies with at least the first using authentication - so default single-proxy or no-proxy setups are unaffected, and the leaked value is a Digest response rather than a cleartext password.
Impact

The signals conflict. The input CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) overstates real-world risk: this is fundamentally an information-disclosure bug (vendor tag: 'Information Disclosure'), so the I:H integrity claim is not supported by the description and should be treated as suspect - verify with the curl advisory. Exploitation is not attacker-triggered in the classic sense; it requires the victim application to (a) reuse one handle across transfers, (b) use env-var proxy configuration, and (c) route sequential requests through two different proxies, with the 'attacker' being the operator of proxyB who passively receives the leaked header. That makes attack complexity effectively high and the practical blast radius narrow, which aligns with the low EPSS (0.25%, 16th percentile) and absence from CISA KEV. Net: a real but conditional confidentiality issue, patch-worthy given libcurl's ubiquity, but not an emergency-priority network RCE despite the 9.1 headline number.
Exploit ScenarioDerived

An application (e.g., a scraper or CI job) reuses one libcurl handle and honors env-var proxy settings, first fetching through corporate proxyA with Digest auth, then through a different proxyB. libcurl resends proxyA's Proxy-Authorization header to proxyB, whose operator (a malicious or compromised proxy) captures the leaked Digest credentials. No public exploit is identified at time of analysis; the attack is passive collection by the receiving proxy rather than an active injection.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 06, 2026

Proxy credential leakage in libcurl (curl) occurs when a single reused easy handle drives sequential transfers through different environment-variable-configured proxies: after Digest-authenticating to proxyA, libcurl fails to reset the proxy authentication state, so the Proxy-Authorization: header meant for proxyA is resent to proxyB. Any application relying on handle reuse with env-var proxy settings and multiple upstream proxies can disclose proxyA's credentials to an unauthorized proxy operator. EPSS is low (0.25%, 16th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis - this is a credential-confidentiality issue rather than a code-execution flaw.

Earlier versions of this analysis (2)
v2 Jul 06, 2026 - 18:37 cvss changed CVSS 9.1

Proxy credential disclosure in libcurl (all releases through 8.20.0) allows a Digest proxy-authentication header intended for one proxy to leak to a different proxy. When an application reuses a single libcurl handle for sequential transfers driven by environment-variable proxy configuration, the Proxy-Authorization state from an initial authenticated request to proxyA is not cleared and is erroneously reused when a later request is routed through proxyB, exposing proxyA's Digest credentials to whoever operates proxyB. There is no public exploit identified at time of analysis, EPSS is low (0.25%, 16th percentile), and a vendor patch is available (Ubuntu USN-8487-1).

v1 Jun 24, 2026 - 18:25

Digest authentication credentials set via environment variables leak across proxy connections in curl versions up to 8.20.0. When env-configured Digest auth state is incorrectly carried over during connection reuse to a different proxy, curl may transmit those credentials to an unintended proxy. No public exploit has been identified at time of analysis, and the curl project rated this MEDIUM severity - consistent with credential disclosure without direct code execution impact. The fix is included in curl 8.21.0, released June 24, 2026.

RemediationAI

Patch available per vendor advisory - upgrade libcurl/curl to the fixed release published by the curl project (see https://curl.se/docs/CVE-2026-8927.html; the exact patched version is not stated in the provided data and should be confirmed against that advisory) and apply your distribution's update, e.g. Ubuntu via USN-8487-1 (https://ubuntu.com/security/notices/USN-8487-1). Until patched, the most direct compensating control is to avoid reusing a single libcurl handle across transfers that target different proxies - create a fresh handle per proxy destination or explicitly clear proxy auth (reset CURLOPT_PROXYUSERPWD / disable proxy Digest) between transfers, which costs some connection-reuse efficiency. Alternatively, stop relying on environment-variable proxy configuration for multi-proxy workflows and set the proxy explicitly per request, or route all traffic through a single trusted proxy so no cross-proxy leak is possible; both reduce flexibility but eliminate the leak path.

Affected VersionsENISA

curl 7.76.0 ≤7.76.0
curl 7.21.4 ≤7.21.4
curl 7.44.0 ≤7.44.0
curl 7.48.0 ≤7.48.0
curl 8.6.0 ≤8.6.0
curl 7.24.0 ≤7.24.0
curl 7.60.0 ≤7.60.0
curl 7.58.0 ≤7.58.0
curl 7.20.0 ≤7.20.0
curl 8.15.0 ≤8.15.0
curl 7.28.0 ≤7.28.0
curl 7.55.1 ≤7.55.1
curl 7.18.0 ≤7.18.0
curl 7.18.2 ≤7.18.2
curl 8.10.0 ≤8.10.0
curl 7.32.0 ≤7.32.0
curl 7.63.0 ≤7.63.0
curl 7.88.1 ≤7.88.1
curl 7.30.0 ≤7.30.0
curl 8.10.1 ≤8.10.1
curl 7.79.1 ≤7.79.1
curl 7.42.0 ≤7.42.0
curl 7.53.1 ≤7.53.1
curl 7.47.1 ≤7.47.1
curl 7.50.3 ≤7.50.3
curl 7.64.0 ≤7.64.0
curl 8.11.0 ≤8.11.0
curl 7.45.0 ≤7.45.0
curl 7.15.2 ≤7.15.2
curl 7.27.0 ≤7.27.0
curl 7.21.6 ≤7.21.6
curl 8.5.0 ≤8.5.0
curl 7.15.1 ≤7.15.1
curl 7.65.2 ≤7.65.2
curl 8.11.1 ≤8.11.1
curl 7.83.1 ≤7.83.1
curl 7.14.0 ≤7.14.0
curl 7.23.0 ≤7.23.0
curl 7.73.0 ≤7.73.0
curl 7.12.3 ≤7.12.3
curl 7.84.0 ≤7.84.0
curl 8.2.1 ≤8.2.1
curl 8.7.0 ≤8.7.0
curl 7.12.2 ≤7.12.2
curl 7.82.0 ≤7.82.0
curl 7.49.1 ≤7.49.1
curl 8.14.0 ≤8.14.0
curl 7.66.0 ≤7.66.0
curl 7.50.1 ≤7.50.1
curl 7.40.0 ≤7.40.0
curl 7.42.1 ≤7.42.1
curl 8.1.0 ≤8.1.0
curl 7.54.1 ≤7.54.1
curl 7.85.0 ≤7.85.0
curl 7.19.2 ≤7.19.2
curl 7.62.0 ≤7.62.0
curl 7.15.0 ≤7.15.0
curl 7.72.0 ≤7.72.0
curl 8.12.1 ≤8.12.1
curl 7.65.0 ≤7.65.0
curl 7.19.4 ≤7.19.4
curl 7.16.0 ≤7.16.0
curl 7.35.0 ≤7.35.0
curl 7.19.0 ≤7.19.0
curl 8.16.0 ≤8.16.0
curl 7.68.0 ≤7.68.0
curl 7.15.3 ≤7.15.3
curl 8.1.2 ≤8.1.2
curl 8.0.1 ≤8.0.1
curl 7.79.0 ≤7.79.0
curl 7.69.0 ≤7.69.0
curl 7.13.1 ≤7.13.1
curl 8.20.0 ≤8.20.0
curl 7.81.0 ≤7.81.0
curl 7.65.1 ≤7.65.1
curl 7.31.0 ≤7.31.0
curl 7.52.1 ≤7.52.1
curl 7.65.3 ≤7.65.3
curl 7.57.0 ≤7.57.0
curl 7.16.1 ≤7.16.1
curl 7.47.0 ≤7.47.0
curl 7.13.0 ≤7.13.0
curl 7.51.0 ≤7.51.0
curl 8.17.0 ≤8.17.0
curl 7.29.0 ≤7.29.0
curl 7.23.1 ≤7.23.1
curl 7.69.1 ≤7.69.1
curl 7.15.5 ≤7.15.5
curl 7.21.0 ≤7.21.0
curl 7.56.1 ≤7.56.1
curl 7.14.1 ≤7.14.1
curl 7.59.0 ≤7.59.0
curl 7.88.0 ≤7.88.0
curl 7.50.2 ≤7.50.2
curl 7.80.0 ≤7.80.0
curl 7.37.1 ≤7.37.1
curl 7.70.0 ≤7.70.0
curl 7.13.2 ≤7.13.2
curl 7.22.0 ≤7.22.0
curl 7.41.0 ≤7.41.0
curl 7.64.1 ≤7.64.1
curl 7.37.0 ≤7.37.0
curl 8.0.0 ≤8.0.0
curl 7.56.0 ≤7.56.0
curl 7.19.7 ≤7.19.7
curl 7.61.0 ≤7.61.0
curl 8.14.1 ≤8.14.1
curl 7.19.5 ≤7.19.5
curl 7.83.0 ≤7.83.0
curl 7.86.0 ≤7.86.0
curl 7.16.2 ≤7.16.2
curl 7.28.1 ≤7.28.1
curl 7.15.4 ≤7.15.4
curl 7.38.0 ≤7.38.0
curl 8.13.0 ≤8.13.0
curl 7.20.1 ≤7.20.1
curl 8.18.0 ≤8.18.0
curl 7.52.0 ≤7.52.0
curl 7.43.0 ≤7.43.0
curl 7.53.0 ≤7.53.0
curl 7.87.0 ≤7.87.0
curl 7.71.0 ≤7.71.0
curl 7.75.0 ≤7.75.0
curl 7.74.0 ≤7.74.0
curl 8.2.0 ≤8.2.0
curl 8.4.0 ≤8.4.0
curl 7.19.3 ≤7.19.3
curl 7.61.1 ≤7.61.1
curl 7.77.0 ≤7.77.0
curl 7.16.3 ≤7.16.3
curl 8.7.1 ≤8.7.1
curl 7.67.0 ≤7.67.0
curl 7.12.1 ≤7.12.1
curl 7.21.3 ≤7.21.3
curl 7.17.0 ≤7.17.0
curl 7.12.0 ≤7.12.0
curl 7.16.4 ≤7.16.4
curl 8.19.0 ≤8.19.0
curl 7.78.0 ≤7.78.0
curl 8.9.0 ≤8.9.0
curl 7.21.2 ≤7.21.2
curl 7.18.1 ≤7.18.1
curl 7.25.0 ≤7.25.0
curl 8.12.0 ≤8.12.0
curl 8.8.0 ≤8.8.0
curl 7.46.0 ≤7.46.0
curl 7.34.0 ≤7.34.0
curl 7.49.0 ≤7.49.0
curl 7.71.1 ≤7.71.1
curl 7.33.0 ≤7.33.0
curl 7.36.0 ≤7.36.0
curl 8.9.1 ≤8.9.1
curl 8.1.1 ≤8.1.1
curl 7.17.1 ≤7.17.1
curl 7.19.1 ≤7.19.1
curl 7.55.0 ≤7.55.0
curl 7.50.0 ≤7.50.0
curl 7.21.5 ≤7.21.5
curl 7.21.7 ≤7.21.7
curl 7.26.0 ≤7.26.0
curl 7.76.1 ≤7.76.1
curl 7.19.6 ≤7.19.6
curl 8.3.0 ≤8.3.0
curl 7.21.1 ≤7.21.1
curl 7.54.0 ≤7.54.0
curl 7.39.0 ≤7.39.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libcurl is the transfer library underpinning the curl CLI and is embedded in a vast range of software, language runtimes, and appliances. The bug lives in libcurl's proxy authentication state handling: when a handle is reused (a common performance optimization to preserve connections and settings), per-request proxy auth material is not cleared before the next transfer. When proxy destinations are selected via environment variables (http_proxy/https_proxy/etc.) and differ between transfers, the cached Digest Proxy-Authorization header for the previous proxy carries over. The CWE is listed as N/A upstream, but the root-cause class is CWE-200 (Exposure of Sensitive Information) combined with CWE-212 (Improper Removal of Sensitive Information before reuse) - sensitive per-authority state is not sanitized across a state boundary. Because it is a Digest header (not Basic), the leaked value is a response hash tied to a challenge, but it still discloses that credentials exist for proxyA and can aid credential attacks against the intended proxy.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (CNA) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI 5.9 MEDIUM

Passive credential disclosure requiring reused handle, env-var proxy config, and two differing proxies drives AC:H; impact is confidentiality-only, so I:N/A:N and no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Red Hat 7.5 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Analysis Updated
Jul 06, 2026 - 18:37 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 06, 2026 - 18:37 vuln.today
v2 - CVSS changed
CVSS changed
Jul 06, 2026 - 18:22 NVD
9.1 (CRITICAL)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

libcurl versions containing this vulnerability can leak proxy authentication credentials when applications reuse connections across multiple proxies, creating an infrastructure access control gap. This affects any organization using curl-based services with multi-proxy architectures or shared proxy environments. Despite low active exploitation indicators (0.2% EPSS), the CRITICAL severity rating and credential-exposure nature of this flaw warrant immediate patching to prevent lateral movement through infrastructure.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 84% exploitable
Prevalence
Ubiquitous
libcurl is embedded in nearly every OS, runtime, and appliance
Threat Intel
1
1 sources
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

56
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-294 – Authentication Bypass by Capture-replay

View all
CVE-2017-3191 CRITICAL
9.8
CVE-2026-62911 HIGH POC
8.0
CVE-2017-6823 HIGH POC
8.8
CVE-2023-1886 CRITICAL POC
9.8
CVE-2023-1537 CRITICAL POC
9.8
CVE-2022-29334 CRITICAL POC
9.8
CVE-2021-27289 CRITICAL POC
9.1
CVE-2022-31277 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-293-05
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:29017 ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-8927 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://ubuntu.com/security/notices/USN-8487-1 ADVISORY https://vuldb.com/vuln/376073 REF https://curl.se/docs/CVE-2026-8927.html REF https://curl.se/docs/CVE-2026-8927.json REF https://hackerone.com/reports/3744543

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy