Is CVE-2026-3784 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3784 being exploited in the wild.

How severe is CVE-2026-3784?

Medium severity, with a CVSS score of 6.5, published 11 March 2026.

Which products and versions are affected?

Haxx Curl 7.7 to 8.18.0; Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.

Is there a fix for CVE-2026-3784?

A patch was published on 2026-03-11: Fixed in curl 8.19.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3784 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3784?

Check whether you run Haxx Curl, Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3784: curl wrong proxy connection reuse with credentials

CVE-2026-3784 · Severity: medium · CVSS 6.5 · Published 2026-03-11

curl, a widely used tool for transferring data over networks, contains a flaw in how it handles secure connections through proxy servers. The software may incorrectly reuse an existing connection for a new request even if that new request requires different login credentials. This could allow unauthorized data transfer or lead to information being sent using the wrong identity, potentially compromising account security or data privacy.

Technologies: Haxx Curl, Siemens RUGGEDCOM RST2428P, Siemens SINEC OS. Vendors: Haxx, Siemens.

Quick answers

Is CVE-2026-3784 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3784 being exploited in the wild.
How severe is CVE-2026-3784?: Medium severity, with a CVSS score of 6.5, published 11 March 2026.
Which products and versions are affected?: Haxx Curl 7.7 to 8.18.0; Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.
Is there a fix for CVE-2026-3784?: A patch was published on 2026-03-11: Fixed in curl 8.19.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3784 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3784?: Check whether you run Haxx Curl, Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in curl's connection reuse logic (CWE-305). When performing an HTTP CONNECT request through a proxy, curl may fail to distinguish between connections requiring different proxy authentication credentials. Instead of creating a new connection for the new credentials, it reuses an existing established connection. This flaw was introduced in version 7.7 and affects both the libcurl library and the command-line tool. An attacker could potentially leverage this to bypass authentication or cause data to be transmitted over a connection authenticated by a different user. The issue is fixed in curl version 8.19.0.

Affected products

haxx curl 7.7 to 8.18.0
Siemens SINEC OS before V4.0
Siemens RUGGEDCOM RST2428P before V4.0

Timeline

2026-03-04: disclosed: Reported to the curl project via HackerOne
2026-03-11: patched: Fixed in curl 8.19.0
2026-03-11: advisory: Project curl advisory published
2026-06-02: advisory: Siemens published downstream advisory SSA-253495

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.