CVE-2026-3784 — Authentication Bypass by Primary Weakness in Curl
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 96.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 11
Latest updateMar 16
Description
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a
server, even if the new request uses different credentials for the HTTP proxy.
The proper behavior is to create or use a separate connection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5
Patches
🔴Vulnerability Details
5OSV▶
CVE-2026-3784: curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP↗2026-03-11
GHSA▶
GHSA-5q3w-6p3j-mw6p: curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a
server, even if the new request uses different credentials for the HTTP↗2026-03-11
📋Vendor Advisories
5Debian▶
CVE-2026-3784: curl - curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a se...↗2026