Is CVE-2026-6253 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6253 being exploited in the wild.

How severe is CVE-2026-6253?

Medium severity, with a CVSS score of 5.9, published 13 May 2026.

Which products and versions are affected?

curl curl 7.14.1 to 8.19.0; curl libcurl 7.14.1 to 8.19.0.

Is there a fix for CVE-2026-6253?

A patch was published on 2026-04-29: Fixed in curl 8.20.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6253 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6253?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6253: curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1.

CVE-2026-6253 · Severity: medium · CVSS 5.9 · Published 2026-05-13

curl is a widely used tool and library for transferring data over various network protocols. A vulnerability exists where curl may accidentally send login credentials intended for one proxy server to a different, second proxy server during a web redirect. This could lead to the exposure of sensitive proxy authentication details to unauthorized third parties managing the second proxy.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-6253 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6253 being exploited in the wild.
How severe is CVE-2026-6253?: Medium severity, with a CVSS score of 5.9, published 13 May 2026.
Which products and versions are affected?: curl curl 7.14.1 to 8.19.0; curl libcurl 7.14.1 to 8.19.0.
Is there a fix for CVE-2026-6253?: A patch was published on 2026-04-29: Fixed in curl 8.20.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6253 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6253?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A credential leak vulnerability (CWE-522) exists in curl and libcurl when configured to use different proxies for different URL schemes. If a request using a proxy that requires authentication is redirected to a URL using a different scheme that uses a second, unauthenticated proxy, curl may erroneously forward the first proxy's Base64-encoded credentials to the second proxy. This occurs because the credential state is not properly cleared or isolated during the transition between different proxy configurations during a redirect. The issue affects versions 7.14.1 through 8.19.0 and is fixed in version 8.20.0.

Affected products

curl curl 7.14.1 to 8.19.0
curl libcurl 7.14.1 to 8.19.0

Timeline

2026-04-13: disclosed: Reported to the curl project
2026-04-29: patched: Fixed in curl 8.20.0
2026-04-29: advisory: Project advisory published
2026-05-13: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.