CVE-2026-9079

Description

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Metadata

CVE ID: CVE-2026-9079
State: PUBLISHED
Assigner: curl
Reserved: 2026-05-20 12:59 UTC
Published: 2026-07-03 06:16 UTC
Last updated: 2026-07-03 06:16 UTC
Vendor / Product: curl / curl
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
curl	curl	—	8.20.0 ≤ 8.20.0, 8.19.0 ≤ 8.19.0, 8.18.0 ≤ 8.18.0, 8.17.0 ≤ 8.17.0 …

Weakness (CWE)

CWE	Source	Description
—	cna	CWE-522 Insufficiently Protected Credentials

References (3)

json https://curl.se/docs/CVE-2026-9079.json
www https://curl.se/docs/CVE-2026-9079.html
issue https://hackerone.com/reports/3750295

Back to overview