CVE-2026-9079 | libcurl had a flaw that when instructed to clear proxy authe… | CVSS 9.8 CRITICAL

Description

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Metadata

CVE ID: CVE-2026-9079
State: PUBLISHED
Assigner: curl
Reserved: 2026-05-20 12:59 UTC
Published: 2026-07-03 06:16 UTC
Last updated: 2026-07-06 16:49 UTC
Vendor / Product: curl / curl
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
curl	curl	—	8.20.0 ≤ 8.20.0, 8.19.0 ≤ 8.19.0, 8.18.0 ≤ 8.18.0, 8.17.0 ≤ 8.17.0 …

Weakness (CWE)

CWE	Source	Description
—	cna	CWE-522 Insufficiently Protected Credentials

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (3)