libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know…
Critical CVSS 9.8
Summary
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://curl.se/docs/CVE-2026-9079.html Patch
- https://curl.se/docs/CVE-2026-9079.json Vendor Advisory
- https://hackerone.com/reports/3750295 Exploit
- https://hackerone.com/reports/3750295 Exploit
Timeline
- nvd_ingest NVD