CVE-2026-9079

Critical · CVSS 9.8

libcurl — Insufficiently Protected Credentials (CWE-522) - Proxy authentication credentials not cleared

CVSS: 9.8; nvd
EPSS: 0.75%; 51th pct
KEV: No
Class: other; CWE-522

Description

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Search profile — drives PoC discovery

Symbols CURLOPT_PROXYUSERPWDCURLOPT_PROXYPASSWORDCURLOPT_PROXYUSERNAMEproxy_authCurl_clear_proxy_credentialsconn->http_proxyproxyuserproxypasswdCURLAUTH_ANYcurl_easy_setopt

Keywords CVE-2026-9079libcurlproxy authentication credentialscredentials not clearedproxy credentials leakcurl proxy auth persistencecredential reuse curlCWE-522 curlcurl proxy credential flawhackerone 3750295

Versions: <UNKNOWN>

References

https://curl.se/docs/CVE-2026-9079.html
https://curl.se/docs/CVE-2026-9079.json
https://hackerone.com/reports/3750295
https://hackerone.com/reports/3750295

Status: enriched · ingested 2026-07-07T18:00:32.000Z · profiled 2026-07-07T18:30:32.000Z