Executive brief
curl, a widely used tool for transferring data over networks, contains a flaw in how it handles secure connections through proxy servers. The software may incorrectly reuse an existing connection for a new request even if that new request requires different login credentials. This could allow unauthorized data transfer or lead to information being sent using the wrong identity, potentially compromising account security or data privacy.
Technical details
A vulnerability exists in curl's connection reuse logic (CWE-305). When performing an HTTP CONNECT request through a proxy, curl may fail to distinguish between connections requiring different proxy authentication credentials. Instead of creating a new connection for the new credentials, it reuses an existing established connection. This flaw was introduced in version 7.7 and affects both the libcurl library and the command-line tool. An attacker could potentially leverage this to bypass authentication or cause data to be transmitted over a connection authenticated by a different user. The issue is fixed in curl version 8.19.0.
Affected products
- haxx curl 7.7 to 8.18.0
- Siemens SINEC OS before V4.0
- Siemens RUGGEDCOM RST2428P before V4.0
Timeline
- 2026-03-04: disclosed: Reported to the curl project via HackerOne
- 2026-03-11: patched: Fixed in curl 8.19.0
- 2026-03-11: advisory: Project curl advisory published
- 2026-06-02: advisory: Siemens published downstream advisory SSA-253495