CVE-2026-8927
published 2026-07-03CVE-2026-8927: When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication…
PriorityP357critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.50%
40.7th percentile
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Affected
174 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect unintended Proxy-Authorization header leakage in libcurl by monitoring for Proxy-Authorization headers being sent to a proxy that differs from the one originally authenticated against, particularly in sequential transfers reusing the same libcurl handle. ↗
- →Focus detection on libcurl handle reuse patterns where environment-variable proxy configuration (e.g., http_proxy, https_proxy) is used across sequential transfers — the auth state is not cleared between requests, leading to header leakage. ↗
- →Monitor network traffic for Proxy-Authorization: Digest headers being sent to unexpected or secondary proxy endpoints, which may indicate exploitation of this flaw in environments with multiple proxy configurations. ↗
- →Audit affected packages in Red Hat environments: curl (Red Hat Hardened Images), rust (Red Hat Hardened Images), libcurl-1.dll and libcurl.so (Red Hat JBoss Core Services) are confirmed affected and should be prioritized for patching and monitoring. ↗
- ·dotnet8.0 on Red Hat Enterprise Linux 8 is confirmed NOT affected by this CVE and should not be prioritized for remediation. ↗
- ·No mitigation is currently available that meets Red Hat Product Security criteria; patching is the only viable remediation path. ↗
- ·The vulnerability only impacts confidentiality (credential leakage via Proxy-Authorization header); no integrity impact has been observed. ↗
- ·The flaw is specifically triggered by environment-variable-driven proxy configuration (e.g., http_proxy/https_proxy env vars), not by programmatically set proxy options in libcurl. ↗
- ·The davix package (EPEL) is also tracked for this CVE; community package maintainers must independently verify if the flaw affects their build before updating. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat9.1CRITICAL
vendor_ubuntu8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
curl regression
vendor_ubuntu·2026-09-28·CVSS 8.1
CVE-2026-8286 [HIGH] curl regression
Title: curl regression
Summary: USN-8487-1 introduced a regression in curl.
USN-8487-1 fixed vulnerabilities in curl. Unfortunately that update
contained an incomplete fix for CVE-2026-8927. This update fixes the
problem.
Original advisory details:
Andrew Nesbitt discovered that curl could reuse an existing live
connection during STARTTLS-based connection upgrades even when the TLS
configuration did not match. A remote attacker could possibly use this
issue to cause curl to use an unintended TLS configuration.
(CVE-2026-8286)
Muhamad Arga Reksapati discovered that curl incorrectly reused connections
for Negotiate-authenticated requests when different services were
involved. A remote attacker could possibly use this issue to access
resources authenticated for another service. This issu
Ubuntu
curl vulnerabilities
vendor_ubuntu·2026-09-24·CVSS 7.4
CVE-2026-80229 [HIGH] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for
LDAP authentication in certain circumstances. A machine-in-the-middle
attacker could possibly use this issue to bypass peer validation. This
issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-13608)
Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server
Push streams when sharing connections between handles. A remote attacker
could possibly use this issue to cause curl to crash, resulting in a denial
of service, or execute arbitrary code. (CVE-2026-18924)
Stanislav Fort discovered that curl incorrectly managed the lifetime of
pooled TLS connections when using the multi interface. An attacker could
pos
Red Hat
libcurl: libcurl: Information disclosure due to uncleared proxy authentication state
vendor_redhat·2026-07-03·CVSS 9.1
CVE-2026-8927 [CRITICAL] CWE-201 libcurl: libcurl: Information disclosure due to uncleared proxy authentication state
libcurl: libcurl: Information disclosure due to uncleared proxy authentication state
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of `Proxy-Authorization` headers to an incorrect proxy, potentiall
Ubuntu
curl vulnerabilities
vendor_ubuntu·2026-06-30
CVE-2026-8286 curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Andrew Nesbitt discovered that curl could reuse an existing live
connection during STARTTLS-based connection upgrades even when the TLS
configuration did not match. A remote attacker could possibly use this
issue to cause curl to use an unintended TLS configuration.
(CVE-2026-8286)
Muhamad Arga Reksapati discovered that curl incorrectly reused
connections for Negotiate-authenticated requests when different services
were involved. A remote attacker could possibly use this issue to access
resources authenticated for another service. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,
Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8458)
It was discovered that curl i
GHSA
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests.
ghsa_unreviewed·2026-07-03
CVE-2026-8927 When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-8927 stgit: Information disclosure due to uncleared proxy authentication state [fedora-all]
bugzilla·2026-07-30·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 stgit: Information disclosure due to uncleared proxy authentication state [fedora-all]
CVE-2026-8927 stgit: Information disclosure due to uncleared proxy authentication state [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Bugzilla
CVE-2026-8927 rust: Information disclosure due to uncleared proxy authentication state [fedora-all]
bugzilla·2026-07-30·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 rust: Information disclosure due to uncleared proxy authentication state [fedora-all]
CVE-2026-8927 rust: Information disclosure due to uncleared proxy authentication state [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Bugzilla
CVE-2026-8927 curl: Information disclosure due to uncleared proxy authentication state [fedora-all]
bugzilla·2026-07-30·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 curl: Information disclosure due to uncleared proxy authentication state [fedora-all]
CVE-2026-8927 curl: Information disclosure due to uncleared proxy authentication state [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Bugzilla
CVE-2026-8927 rustup: Information disclosure due to uncleared proxy authentication state [fedora-all]
bugzilla·2026-07-30·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 rustup: Information disclosure due to uncleared proxy authentication state [fedora-all]
CVE-2026-8927 rustup: Information disclosure due to uncleared proxy authentication state [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Bugzilla
CVE-2026-8927 rpi-imager: Information disclosure due to uncleared proxy authentication state [fedora-all]
bugzilla·2026-07-30·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 rpi-imager: Information disclosure due to uncleared proxy authentication state [fedora-all]
CVE-2026-8927 rpi-imager: Information disclosure due to uncleared proxy authentication state [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Bugzilla
CVE-2026-8927 trustee-guest-components: Information disclosure due to uncleared proxy authentication state [fedora-all]
bugzilla·2026-07-30·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 trustee-guest-components: Information disclosure due to uncleared proxy authentication state [fedora-all]
CVE-2026-8927 trustee-guest-components: Information disclosure due to uncleared proxy authentication state [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Discussion:
The Fedora trustee-guest-components does not
Bugzilla
CVE-2026-8927 nushell: Information disclosure due to uncleared proxy authentication state [epel-all]
bugzilla·2026-07-30·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 nushell: Information disclosure due to uncleared proxy authentication state [epel-all]
CVE-2026-8927 nushell: Information disclosure due to uncleared proxy authentication state [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Bugzilla
CVE-2026-8927 nushell: Information disclosure due to uncleared proxy authentication state [fedora-all]
bugzilla·2026-07-30·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 nushell: Information disclosure due to uncleared proxy authentication state [fedora-all]
CVE-2026-8927 nushell: Information disclosure due to uncleared proxy authentication state [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Bugzilla
CVE-2026-8927 mingw-curl: Information disclosure due to uncleared proxy authentication state [fedora-all]
bugzilla·2026-07-30·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 mingw-curl: Information disclosure due to uncleared proxy authentication state [fedora-all]
CVE-2026-8927 mingw-curl: Information disclosure due to uncleared proxy authentication state [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Bugzilla
CVE-2026-8927 davix: libcurl: Information disclosure due to uncleared proxy authentication state [epel-all]
bugzilla·2026-07-06·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 davix: libcurl: Information disclosure due to uncleared proxy authentication state [epel-all]
CVE-2026-8927 davix: libcurl: Information disclosure due to uncleared proxy authentication state [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Bugzilla
CVE-2026-8927 libcurl: libcurl: Information disclosure due to uncleared proxy authentication state
bugzilla·2026-07-03·CVSS 9.1
CVE-2026-8927 [CRITICAL] CVE-2026-8927 libcurl: libcurl: Information disclosure due to uncleared proxy authentication state
CVE-2026-8927 libcurl: libcurl: Information disclosure due to uncleared proxy authentication state
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
2026-07-03
Published