Executive brief
curl is a widely used tool and library for transferring data over various network protocols. A vulnerability exists where curl may accidentally send login credentials intended for one proxy server to a different, second proxy server during a web redirect. This could lead to the exposure of sensitive proxy authentication details to unauthorized third parties managing the second proxy.
Technical details
A credential leak vulnerability (CWE-522) exists in curl and libcurl when configured to use different proxies for different URL schemes. If a request using a proxy that requires authentication is redirected to a URL using a different scheme that uses a second, unauthenticated proxy, curl may erroneously forward the first proxy's Base64-encoded credentials to the second proxy. This occurs because the credential state is not properly cleared or isolated during the transition between different proxy configurations during a redirect. The issue affects versions 7.14.1 through 8.19.0 and is fixed in version 8.20.0.
Affected products
- curl curl 7.14.1 to 8.19.0
- curl libcurl 7.14.1 to 8.19.0
Timeline
- 2026-04-13: disclosed: Reported to the curl project
- 2026-04-29: patched: Fixed in curl 8.20.0
- 2026-04-29: advisory: Project advisory published
- 2026-05-13: other: NVD publication date