9.8Kritisch

CVE-2026-9079stale proxy password leak

curl curl Veröffentlicht: 2026-07-03 09:16 (vor 4 Monaten)

Beschreibung

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Schwachstellentyp (CWE): CWE-522

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
curl	curl	8.8.0 – < 8.14.2, 8.15.0 – < 8.16.1, 8.17.0 – < 8.20.1
haxx	curl	8.8.0 – < 8.21.0

Referenzen und Patches

https://curl.se/docs/CVE-2026-9079.json Vendor Advisory
https://curl.se/docs/CVE-2026-9079.html PatchVendor Advisory
https://hackerone.com/reports/3750295 ExploitIssue TrackingThird Party Advisory

CPE-Treffer (NVD) (1)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* ≥ 8.8.0 < 8.21.0

CVSS-Score

9.8Kritisch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (2)

CISA-ADP	CVSS 3.1	9.8Kritisch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Kritisch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

1.06%

höher als 65 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: poc
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2026-05-20
Veröffentlicht2026-07-03 09:16
Bei IP-DB eingegangen2026-10-24 23:46
Zuletzt aktualisiert2026-09-15 10:16

Vergeben von (CNA): curl
NVD-Status: Modified

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — curl / libcurl

8.1Hoch

CVE-2026-107929 vor 22 Tagen

local interface connection reuse mixup

curl curl

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…

8.1Hoch

CVE-2026-107928 vor 22 Tagen

info leak uploading over WebSockets with GnuTLS

curl curl

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…

7.5Hoch

CVE-2026-94266 vor 22 Tagen

password leak in CURLINFO_EFFECTIVE_URL

curl curl

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

9.1Kritisch

CVE-2026-94265 vor 22 Tagen

Authorization: Negotiate sent to foreign origin

curl curl

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…

7.5Hoch

CVE-2026-92391 vor 22 Tagen

curl_mime_free stack overflow by recursion

curl curl

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…

1.2%EPSS

7.5Hoch

CVE-2026-92390 vor 22 Tagen

-J no-clobber guarantee bypassed with 103 early hints

curl curl

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…