Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
curl may expose proxy credentials via reused connection
published 7 months ago
Summary
Versions of curl before 8.11.1-6 can reuse an existing proxy link even when a new request provides different login details. This means the new request might be sent with the previous credentials, potentially revealing them or allowing access that should be denied. Upgrade curl to version 8.11.1-6 or later, or avoid changing proxy credentials on the same connection until the update is applied.
What to do
- Update azure curl to version 8.11.1-6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | curl |
< 8.11.1-6 Fix: upgrade to 8.11.1-6
|
Original advisory text
CVE-2026-3784 affecting package curl for versions less than 8.11.1-6
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a
server, even if the new request uses different credentials for the HTTP proxy.
The proper behavior is to create or use a separate connection.
server, even if the new request uses different credentials for the HTTP proxy.
The proper behavior is to create or use a separate connection.
References
Timeline
Published11 Mar 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-79679 · OSV
Track software like this
Free during beta