Skip to main content

libcurl CVE-2026-9079

| EUVDEUVD-2026-41510 CRITICAL
Insufficiently Protected Credentials (CWE-522)
2026-06-24 GHSA-f4cv-xm48-3694
Information Disclosure Curl Haxx
9.8
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    App sets proxy auth on reused handle
  2. Delivery
    App requests credential clear (silently ignored)
  3. Exploit
    Subsequent transfer starts on same handle
  4. Execution
    Stale proxy credentials auto-attached
  5. Impact
    Credentials disclosed to unintended proxy/endpoint

Vulnerability Assessment

Weakness
CWE
CWE-522
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
Exploitation Conditions

Requires an application that reuses a single libcurl easy handle across multiple transfers, first configures proxy authentication credentials, then instructs libcurl to clear those proxy credentials (e.g., resetting CURLOPT_PROXYUSERPWD/CURLOPT_PROXYPASSWORD) before performing a subsequent transfer. The condition that triggers the leak IS the ignored clear operation on a reused handle. Limiting factors: it does not affect callers that use a fresh handle per transfer or that never set-then-clear proxy credentials; there is no direct remote trigger by an external attacker and no user interaction - exposure depends entirely on the host application's handle-reuse and credential-reset pattern, and the disclosed data reaches whatever proxy/endpoint the subsequent transfer targets. Affected versions are curl/libcurl 8.8.0 through 8.20.0.
Impact

The supplied CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is inconsistent with the actual defect and should be treated as an inflated/auto-generated score: this is a confidentiality-only credential-leak bug with no integrity or availability impact and no attacker-driven remote trigger, so claiming full I:H/A:H is unsupported by the description. Corroborating low-risk signals: EPSS is only 0.25% (16th percentile), the tag is 'Information Disclosure,' the CVE is NOT in CISA KEV, and no POC/exploit flag is provided. The realistic risk is that proxy credentials are disclosed to an unintended proxy or endpoint during handle reuse - meaningful for credential hygiene but not a network RCE. Bottom line: high nominal CVSS but low real-world urgency; prioritize as a routine library update rather than an emergency. Conflict to verify with vendor: CVSS says network/low-complexity/unauthenticated with high triad impact, while the description implies a local application-usage pattern with confidentiality-only impact - reconcile against the official curl advisory (curl.se/docs/CVE-2026-9079.html).
Exploit ScenarioDerived

An application embeds libcurl, sets proxy authentication for a transfer through proxy A, then attempts to clear the credentials before reusing the same handle for a transfer through proxy B (or a direct request). Because the clear is ignored, libcurl silently replays proxy A's username and password to proxy B, disclosing them to a party that should never have received them. No public exploit is identified; exploitation is opportunistic on the receiving proxy/server side rather than an attacker-launched remote action.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 06, 2026

Proxy-credential leakage in libcurl (curl 8.8.0 through 8.20.0) occurs because a request to clear previously set proxy authentication credentials is silently ignored, so the stale username/password remain attached to the reused easy handle and are sent on later transfers that were never meant to use them. This is an information-disclosure defect (tagged Information Disclosure, EUVD-2026-41510) affecting applications that reuse libcurl handles across multiple proxied requests. No public exploit identified at time of analysis and EPSS is low (0.25%, 16th percentile), consistent with a coding/logic flaw rather than a directly weaponizable remote bug.

Earlier versions of this analysis (2)
v2 Jul 06, 2026 - 18:30 cvss changed CVSS 9.8

Credential leakage in libcurl (curl 8.8.0 through 8.20.0) occurs because a request to clear proxy authentication credentials is silently ignored, so the stale username/password remain attached to a reused easy handle and are sent on subsequent transfers that were never meant to receive them. An application that reuses a curl handle for connections to different proxies or destinations can therefore disclose proxy credentials to an unintended party. Tagged as Information Disclosure with a low EPSS of 0.25% (16th percentile) and no public exploit identified at time of analysis; a vendor patch is available.

v1 Jun 24, 2026 - 18:26

Stale proxy credentials leak in curl/libcurl allows proxy authentication passwords from a previous transfer to be incorrectly retained and potentially exposed during subsequent connections where those credentials should no longer apply. Affecting curl versions up to and including 8.20.0, this flaw is classified MEDIUM severity by the curl project and is fixed in the 8.21.0 release published June 24, 2026. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.

RemediationAI

Patch available per vendor advisory: upgrade curl/libcurl to the fixed release published on curl.se (curl.se/docs/CVE-2026-9079.html); the input does not state an exact fixed version number, but the fix lands in the release following 8.20.0, so update to that or the newest available build - do not remain on 8.8.0-8.20.0. Distribution users should apply the packaged fix, e.g. Ubuntu USN-8487-1 (ubuntu.com/security/notices/USN-8487-1), and rebuild/redeploy any statically linked applications and language bindings that embed libcurl. As a code-level workaround where immediate upgrade is impossible, avoid relying on clearing proxy credentials on a reused easy handle: allocate a fresh curl easy handle (curl_easy_init) for transfers that must not carry prior proxy credentials, or call curl_easy_reset before reusing a handle - the trade-off is losing connection/handle reuse efficiency. Operationally, treat any proxy credentials that may have leaked to unintended proxies as compromised and rotate them.

Affected VersionsENISA

curl 8.10.1 ≤8.10.1
curl 8.12.1 ≤8.12.1
curl 8.11.1 ≤8.11.1
curl 8.9.0 ≤8.9.0
curl 8.8.0 ≤8.8.0
curl 8.17.0 ≤8.17.0
curl 8.18.0 ≤8.18.0
curl 8.20.0 ≤8.20.0
curl 8.12.0 ≤8.12.0
curl 8.15.0 ≤8.15.0
curl 8.10.0 ≤8.10.0
curl 8.9.1 ≤8.9.1
curl 8.13.0 ≤8.13.0
curl 8.14.1 ≤8.14.1
curl 8.19.0 ≤8.19.0
curl 8.14.0 ≤8.14.0
curl 8.11.0 ≤8.11.0
curl 8.16.0 ≤8.16.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libcurl exposes CURLOPT_PROXYUSERPWD / CURLOPT_PROXYUSERNAME / CURLOPT_PROXYPASSWORD (and related options) on a reusable 'easy handle.' The intended contract is that setting these to NULL/empty clears the stored secret before the handle is reused. The flaw is that the clearing operation does not actually wipe the internal credential state, so the old proxy credentials persist and are automatically applied to subsequent transfers on the same handle - even ones directed at a different proxy or origin. The root-cause class is improper clearing/removal of sensitive information (akin to CWE-212 'Improper Removal of Sensitive Information Before Storage or Transfer'); the input lists CWE as N/A. Because curl is both a ubiquitous command-line tool and, as libcurl, an embedded HTTP library in countless applications and language bindings, the behavior surfaces anywhere handle reuse plus credential reset is used as a programming pattern.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 3.7 LOW

Confidentiality-only credential leak (C:L, I:N, A:N); depends on a specific set-then-clear handle-reuse pattern so AC:H; no attacker auth required, hence PR:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat 7.5 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Updated
Jul 06, 2026 - 18:30 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 06, 2026 - 18:30 vuln.today
v2 - CVSS changed
CVSS changed
Jul 06, 2026 - 18:22 NVD
9.8 (CRITICAL)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Credential Leak in OpenSSL - CVE-2026-9079 Jun 24, 2026

Executive ViewAI

Why It Matters

libcurl versions 8.8.0-8.20.0 leak proxy authentication credentials across unrelated network requests, creating risk of unauthorized access to network infrastructure and systems relying on proxy authentication. Organizations using affected versions face credential exposure whenever applications reuse network connections-a common pattern in long-running services. Patch availability and low current exploitation (0.2% EPSS) enable managed remediation, but prompt action is required given the critical severity (CVSS 9.8).

Business Impact: Severe
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 84% exploitable
Prevalence
Ubiquitous
curl/libcurl embedded in nearly all Linux distros, apps, and language runtimes
Threat Intel
1
1 sources
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

59
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-522 – Insufficiently Protected Credentials

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2021-30116 CRITICAL POC
9.8
CVE-2024-44000 CRITICAL POC
9.8
CVE-2023-6421 HIGH POC
7.5
CVE-2017-8225 CRITICAL POC
9.8
CVE-2025-25570 CRITICAL POC
9.8
CVE-2017-17106 CRITICAL POC
9.8
CVE-2017-8837 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-293-05
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:29017 ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9079 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://ubuntu.com/security/notices/USN-8487-1 ADVISORY https://vuldb.com/vuln/376075 REF https://curl.se/docs/CVE-2026-9079.html REF https://curl.se/docs/CVE-2026-9079.json REF https://hackerone.com/reports/3750295

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy