9.8Critical

CVE-2026-9079stale proxy password leak

curl curl Published: 2026-07-03 09:16 (4 months ago)

Description

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Weakness (CWE): CWE-522

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
curl	curl	8.8.0 – < 8.14.2, 8.15.0 – < 8.16.1, 8.17.0 – < 8.20.1
haxx	curl	8.8.0 – < 8.21.0

References and patches

https://curl.se/docs/CVE-2026-9079.json Vendor Advisory
https://curl.se/docs/CVE-2026-9079.html PatchVendor Advisory
https://hackerone.com/reports/3750295 ExploitIssue TrackingThird Party Advisory

CPE matches (NVD) (1)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* ≥ 8.8.0 < 8.21.0

CVSS score

9.8Critical

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All scores (2)

CISA-ADP	CVSS 3.1	9.8Critical
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Critical

EPSS (chance of exploitation in 30 days)

1.06%

higher than 65% of all CVEs

CISA assessment (SSVC)

Exploitation: poc
Automatable: yes
Technical impact: total

Timeline

ID reserved2026-05-20
Published2026-07-03 09:16
Reached IP-DB2026-10-24 23:46
Last updated2026-09-15 10:16

Assigned by (CNA): curl
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — curl / libcurl

8.1High

CVE-2026-107929 22 days ago

local interface connection reuse mixup

curl curl

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…

8.1High

CVE-2026-107928 22 days ago

info leak uploading over WebSockets with GnuTLS

curl curl

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…

7.5High

CVE-2026-94266 22 days ago

password leak in CURLINFO_EFFECTIVE_URL

curl curl

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

9.1Critical

CVE-2026-94265 22 days ago

Authorization: Negotiate sent to foreign origin

curl curl

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…

7.5High

CVE-2026-92391 22 days ago

curl_mime_free stack overflow by recursion

curl curl

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…

1.2%EPSS

7.5High

CVE-2026-92390 22 days ago

-J no-clobber guarantee bypassed with 103 early hints

curl curl

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…