Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
curl may leak proxy credentials to another proxy
published 5 months ago
Summary
The curl tool can accidentally send login details meant for one proxy to a different proxy when it follows a redirect that switches from one type of web address to another. This could expose passwords to an unintended server. Update curl to the latest version or adjust proxy settings to avoid using mixed proxies.
What to do
- Update azure curl to version 8.11.1-9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | curl |
< 8.11.1-9 Fix: upgrade to 8.11.1-9
|
Original advisory text
CVE-2026-6253 affecting package curl for versions less than 8.11.1-9
curl might erroneously pass on credentials for a first proxy to a second
proxy.
This can happen when the following conditions are true:
1. curl is setup to use specific different proxies for different URL schemes
2. the first proxy needs credentials
3. the second proxy uses no credentials
4. while using the first proxy (using say `http://`), curl is asked to follow
a redirect to a URL using another scheme (say `https://`), accessed using a
second, different, proxy
proxy.
This can happen when the following conditions are true:
1. curl is setup to use specific different proxies for different URL schemes
2. the first proxy needs credentials
3. the second proxy uses no credentials
4. while using the first proxy (using say `http://`), curl is asked to follow
a redirect to a URL using another scheme (say `https://`), accessed using a
second, different, proxy
References
Timeline
Published13 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-86666 · OSV
Track software like this
Free during beta