Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-8927: libcurl Leaks Proxy Authentication Info Between Transfers
CURL-CVE-2026-8927
CVE-2026-8927
CVE-2026-8927
Summary
When using libcurl to transfer data through multiple proxies, sensitive authentication information may be accidentally shared between transfers. This can happen when the proxy settings are changed between transfers and the old authentication credentials are not properly cleared. To avoid this issue, it's recommended to use a new libcurl handle for each transfer or properly clear the proxy authentication state after each transfer.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| curl | curl | <= 8.20.0 |
Original title
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if t...
Original description
When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication state between requests. Specifically, if the initial transfer
authenticates against `proxyA` using Digest auth, a subsequent transfer routed
through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
solely for `proxyA`.
Vulnerability type
CWE-294
Published: 3 Jul 2026 · Updated: 23 Jul 2026 · First seen: 24 Jun 2026