CVE-2026-8927

CRITICAL9.1Auth bypass

Description

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected products

curl / curlfc6eff13b5414caf6edf22d73a3239e074a04216 – 5c225384b8d52c67ce8259c6e4203bc57aacb567
curl / curl8.19.0 – 8.19.0
curl / curl8.18.0 – 8.18.0
curl / curl8.17.0 – 8.17.0
curl / curl8.16.0 – 8.16.0
curl / curl8.15.0 – 8.15.0
curl / curl8.14.1 – 8.14.1
curl / curl8.14.0 – 8.14.0
curl / curl8.13.0 – 8.13.0
curl / curl8.12.1 – 8.12.1
curl / curl8.12.0 – 8.12.0
curl / curl8.11.1 – 8.11.1
curl / curl8.11.0 – 8.11.0
curl / curl8.10.1 – 8.10.1
curl / curl8.10.0 – 8.10.0
curl / curl8.9.1 – 8.9.1
curl / curl8.9.0 – 8.9.0
curl / curl8.8.0 – 8.8.0
curl / curl8.7.1 – 8.7.1
curl / curl8.7.0 – 8.7.0
curl / curl8.6.0 – 8.6.0
curl / curl8.5.0 – 8.5.0
curl / curl8.4.0 – 8.4.0
curl / curl8.3.0 – 8.3.0
curl / curl8.2.1 – 8.2.1
curl / curl8.2.0 – 8.2.0
curl / curl8.1.2 – 8.1.2
curl / curl8.1.1 – 8.1.1
curl / curl8.1.0 – 8.1.0
curl / curl8.0.1 – 8.0.1
curl / curl8.0.0 – 8.0.0
curl / curl7.88.1 – 7.88.1
curl / curl7.88.0 – 7.88.0
curl / curl7.87.0 – 7.87.0
curl / curl7.86.0 – 7.86.0
curl / curl7.85.0 – 7.85.0
curl / curl7.84.0 – 7.84.0
curl / curl7.83.1 – 7.83.1
curl / curl7.83.0 – 7.83.0
curl / curl7.82.0 – 7.82.0
curl / curl7.81.0 – 7.81.0
curl / curl7.80.0 – 7.80.0
curl / curl7.79.1 – 7.79.1
curl / curl7.79.0 – 7.79.0
curl / curl7.78.0 – 7.78.0
curl / curl7.77.0 – 7.77.0
curl / curl7.76.1 – 7.76.1
curl / curl7.76.0 – 7.76.0
curl / curl7.75.0 – 7.75.0
curl / curl7.74.0 – 7.74.0
curl / curl7.73.0 – 7.73.0
curl / curl7.72.0 – 7.72.0
curl / curl7.71.1 – 7.71.1
curl / curl7.71.0 – 7.71.0
curl / curl7.70.0 – 7.70.0
curl / curl7.69.1 – 7.69.1
curl / curl7.69.0 – 7.69.0
curl / curl7.68.0 – 7.68.0
curl / curl7.67.0 – 7.67.0
curl / curl7.66.0 – 7.66.0
curl / curl7.65.3 – 7.65.3
curl / curl7.65.2 – 7.65.2
curl / curl7.65.1 – 7.65.1
curl / curl7.65.0 – 7.65.0
curl / curl7.64.1 – 7.64.1
curl / curl7.64.0 – 7.64.0
curl / curl7.63.0 – 7.63.0
curl / curl7.62.0 – 7.62.0
curl / curl7.61.1 – 7.61.1
curl / curl7.61.0 – 7.61.0
curl / curl7.60.0 – 7.60.0
curl / curl7.59.0 – 7.59.0
curl / curl7.58.0 – 7.58.0
curl / curl7.57.0 – 7.57.0
curl / curl7.56.1 – 7.56.1
curl / curl7.56.0 – 7.56.0
curl / curl7.55.1 – 7.55.1
curl / curl7.55.0 – 7.55.0
curl / curl7.54.1 – 7.54.1
curl / curl7.54.0 – 7.54.0
curl / curl7.53.1 – 7.53.1
curl / curl7.53.0 – 7.53.0
curl / curl7.52.1 – 7.52.1
curl / curl7.52.0 – 7.52.0
curl / curl7.51.0 – 7.51.0
curl / curl7.50.3 – 7.50.3
curl / curl7.50.2 – 7.50.2
curl / curl7.50.1 – 7.50.1
curl / curl7.50.0 – 7.50.0
curl / curl7.49.1 – 7.49.1
curl / curl7.49.0 – 7.49.0
curl / curl7.48.0 – 7.48.0
curl / curl7.47.1 – 7.47.1
curl / curl7.47.0 – 7.47.0
curl / curl7.46.0 – 7.46.0
curl / curl7.45.0 – 7.45.0
curl / curl7.44.0 – 7.44.0
curl / curl7.43.0 – 7.43.0
curl / curl7.42.1 – 7.42.1
curl / curl7.42.0 – 7.42.0
curl / curl7.41.0 – 7.41.0
curl / curl7.40.0 – 7.40.0
curl / curl7.39.0 – 7.39.0
curl / curl7.38.0 – 7.38.0
curl / curl7.37.1 – 7.37.1
curl / curl7.37.0 – 7.37.0
curl / curl7.36.0 – 7.36.0
curl / curl7.35.0 – 7.35.0
curl / curl7.34.0 – 7.34.0
curl / curl7.33.0 – 7.33.0
curl / curl7.32.0 – 7.32.0
curl / curl7.31.0 – 7.31.0
curl / curl7.30.0 – 7.30.0
curl / curl7.29.0 – 7.29.0
curl / curl7.28.1 – 7.28.1
curl / curl7.28.0 – 7.28.0
curl / curl7.27.0 – 7.27.0
curl / curl7.26.0 – 7.26.0
curl / curl7.25.0 – 7.25.0
curl / curl7.24.0 – 7.24.0
curl / curl7.23.1 – 7.23.1
curl / curl7.23.0 – 7.23.0
curl / curl7.22.0 – 7.22.0
curl / curl7.21.7 – 7.21.7
curl / curl7.21.6 – 7.21.6
curl / curl7.21.5 – 7.21.5
curl / curl7.21.4 – 7.21.4
curl / curl7.21.3 – 7.21.3
curl / curl7.21.2 – 7.21.2
curl / curl7.21.1 – 7.21.1
curl / curl7.21.0 – 7.21.0
curl / curl7.20.1 – 7.20.1
curl / curl7.20.0 – 7.20.0
curl / curl7.19.7 – 7.19.7
curl / curl7.19.6 – 7.19.6
curl / curl7.19.5 – 7.19.5
curl / curl7.19.4 – 7.19.4
curl / curl7.19.3 – 7.19.3
curl / curl7.19.2 – 7.19.2
curl / curl7.19.1 – 7.19.1
curl / curl7.19.0 – 7.19.0
curl / curl7.18.2 – 7.18.2
curl / curl7.18.1 – 7.18.1
curl / curl7.18.0 – 7.18.0
curl / curl7.17.1 – 7.17.1
curl / curl7.17.0 – 7.17.0
curl / curl7.16.4 – 7.16.4
curl / curl7.16.3 – 7.16.3
curl / curl7.16.2 – 7.16.2
curl / curl7.16.1 – 7.16.1
curl / curl7.16.0 – 7.16.0
curl / curl7.15.5 – 7.15.5
curl / curl7.15.4 – 7.15.4
curl / curl7.15.3 – 7.15.3
curl / curl7.15.2 – 7.15.2
curl / curl7.15.1 – 7.15.1
curl / curl7.15.0 – 7.15.0
curl / curl7.14.1 – 7.14.1
curl / curl7.14.0 – 7.14.0
curl / curl7.13.2 – 7.13.2
curl / curl7.13.1 – 7.13.1
curl / curl7.13.0 – 7.13.0
curl / curl7.12.3 – 7.12.3
curl / curl7.12.2 – 7.12.2
curl / curl7.12.1 – 7.12.1
curl / curl7.12.0 – 7.12.0
curl / curl8.20.0 – 8.20.0
curl / curl7.12.0 – 8.14.2
curl / curl8.15.0 – 8.16.1
curl / curl8.17.0 – 8.20.1
haxx / curl7.12.0 – 8.21.0

References

Updated 44m ago · 8 sources