# CVE-2026-6253: curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1.

Source: https://junglewise.ai/threats/cve-2026-6253-curl-proxy-credentials-leak-during-redirect-to-different-proxy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-6253 · Severity: medium · CVSS 5.9 · Published 2026-05-13

curl is a widely used tool and library for transferring data over various network protocols. A vulnerability exists where curl may accidentally send login credentials intended for one proxy server to a different, second proxy server during a web redirect. This could lead to the exposure of sensitive proxy authentication details to unauthorized third parties managing the second proxy.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2026-6253 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6253 being exploited in the wild.

**How severe is CVE-2026-6253?** Medium severity, with a CVSS score of 5.9, published 13 May 2026.

**Which products and versions are affected?** curl curl 7.14.1 to 8.19.0; curl libcurl 7.14.1 to 8.19.0.

**Is there a fix for CVE-2026-6253?** A patch was published on 2026-04-29: Fixed in curl 8.20.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6253 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6253?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A credential leak vulnerability (CWE-522) exists in curl and libcurl when configured to use different proxies for different URL schemes. If a request using a proxy that requires authentication is redirected to a URL using a different scheme that uses a second, unauthenticated proxy, curl may erroneously forward the first proxy's Base64-encoded credentials to the second proxy. This occurs because the credential state is not properly cleared or isolated during the transition between different proxy configurations during a redirect. The issue affects versions 7.14.1 through 8.19.0 and is fixed in version 8.20.0.

## Affected products

- curl curl 7.14.1 to 8.19.0
- curl libcurl 7.14.1 to 8.19.0

## Timeline

- 2026-04-13: disclosed: Reported to the curl project
- 2026-04-29: patched: Fixed in curl 8.20.0
- 2026-04-29: advisory: Project advisory published
- 2026-05-13: other: NVD publication date

## References

- [https://curl.se/docs/CVE-2026-6253.html](https://curl.se/docs/CVE-2026-6253.html)
- [https://curl.se/docs/CVE-2026-6253.json](https://curl.se/docs/CVE-2026-6253.json)
- [https://hackerone.com/reports/3669637](https://hackerone.com/reports/3669637)
- [http://www.openwall.com/lists/oss-security/2026/04/29/11](http://www.openwall.com/lists/oss-security/2026/04/29/11)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)