CVE-2026-3784: curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy…

PriorityP335medium6.5CVSS 3.1

AVNACLPRNUINSUCLILAN

EPSS

0.45%

36.7th percentile

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

Affected

214 ranges· showing 25

Vendor	Product	Version range	Fixed in
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—
curl	curl	—	—

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

osv6.5MEDIUM

vendor_debian6.5MEDIUM

vendor_msrc6.5MEDIUM

vendor_redhat6.5MEDIUM

vendor_ubuntu6.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.