9.8Crítica

CVE-2026-9079stale proxy password leak

curl curl Publicada: 2026-07-03 09:16 (hace 4 meses)

Descripción

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Debilidad (CWE): CWE-522

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
curl	curl	8.8.0 – < 8.14.2, 8.15.0 – < 8.16.1, 8.17.0 – < 8.20.1
haxx	curl	8.8.0 – < 8.21.0

Referencias y parches

https://curl.se/docs/CVE-2026-9079.json Vendor Advisory
https://curl.se/docs/CVE-2026-9079.html PatchVendor Advisory
https://hackerone.com/reports/3750295 ExploitIssue TrackingThird Party Advisory

Coincidencias CPE (NVD) (1)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* ≥ 8.8.0 < 8.21.0

Puntuación CVSS

9.8Crítica

Fuente: CISA-ADP · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Alto

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Todas las puntuaciones (2)

CISA-ADP	CVSS 3.1	9.8Crítica
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Crítica

EPSS (probabilidad de explotación en 30 días)

1.06%

superior al 65 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: poc
Automatizable: yes
Impacto técnico: total

Cronología

ID reservado2026-05-20
Publicada2026-07-03 09:16
Llegó a IP-DB2026-10-24 23:46
Última actualización2026-09-15 10:16

Asignada por (CNA): curl
Estado en NVD: Modified

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — curl / libcurl

8.1Alta

CVE-2026-107929 hace 22 días

local interface connection reuse mixup

curl curl

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…

8.1Alta

CVE-2026-107928 hace 22 días

info leak uploading over WebSockets with GnuTLS

curl curl

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…

7.5Alta

CVE-2026-94266 hace 22 días

password leak in CURLINFO_EFFECTIVE_URL

curl curl

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

9.1Crítica

CVE-2026-94265 hace 22 días

Authorization: Negotiate sent to foreign origin

curl curl

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…

7.5Alta

CVE-2026-92391 hace 22 días

curl_mime_free stack overflow by recursion

curl curl

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…

1.2%EPSS

7.5Alta

CVE-2026-92390 hace 22 días

-J no-clobber guarantee bypassed with 103 early hints

curl curl

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…