9.8Kritik

CVE-2026-9079stale proxy password leak

curl curl Yayım: 2026-07-03 09:16 (4 ay önce)

Açıklama

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Zayıflık türü (CWE): CWE-522

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
curl	curl	8.8.0 – < 8.14.2, 8.15.0 – < 8.16.1, 8.17.0 – < 8.20.1
haxx	curl	8.8.0 – < 8.21.0

Kaynaklar ve yamalar

https://curl.se/docs/CVE-2026-9079.json Vendor Advisory
https://curl.se/docs/CVE-2026-9079.html PatchVendor Advisory
https://hackerone.com/reports/3750295 ExploitIssue TrackingThird Party Advisory

CPE eşleşmeleri (NVD) (1)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* ≥ 8.8.0 < 8.21.0

CVSS puanı

9.8Kritik

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tüm puanlar (2)

CISA-ADP	CVSS 3.1	9.8Kritik
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Kritik

EPSS (30 günde istismar olasılığı)

1.06%

tüm CVE'lerin %65'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: poc
Otomatikleştirilebilir: yes
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-05-20
Yayımlandı2026-07-03 09:16
IP-DB'ye ulaştı2026-10-24 23:46
Son güncelleme2026-09-15 10:16

Numarayı veren (CNA): curl
NVD durumu: Modified

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — curl / libcurl

8.1Yüksek

CVE-2026-107929 22 gün önce

local interface connection reuse mixup

curl curl

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…

8.1Yüksek

CVE-2026-107928 22 gün önce

info leak uploading over WebSockets with GnuTLS

curl curl

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…

7.5Yüksek

CVE-2026-94266 22 gün önce

password leak in CURLINFO_EFFECTIVE_URL

curl curl

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

9.1Kritik

CVE-2026-94265 22 gün önce

Authorization: Negotiate sent to foreign origin

curl curl

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…

7.5Yüksek

CVE-2026-92391 22 gün önce

curl_mime_free stack overflow by recursion

curl curl

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…

1.2%EPSS

7.5Yüksek

CVE-2026-92390 22 gün önce

-J no-clobber guarantee bypassed with 103 early hints

curl curl

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…