Executive brief
A vulnerability in the libcurl library, which is widely used by applications to transfer data over the internet, could allow a malicious proxy server to steal authentication credentials. If an application uses one proxy and then switches to a second proxy while reusing the same internal connection handle, the library may mistakenly send the first proxy's login information to the second one. This could allow the operator of the second proxy to impersonate the user when communicating with the first proxy.
Technical details
A state leak exists in libcurl's Digest authentication logic when reusing handles across different HTTP proxies. When an application performs a transfer using Digest auth through 'proxyA' and subsequently changes the proxy configuration to 'proxyB' using the same easy handle, libcurl fails to clear the authentication state. Consequently, the 'Proxy-Authorization' header intended for 'proxyA' is sent to 'proxyB'. An attacker controlling 'proxyB' could capture this header to replay authentication against 'proxyA'. This issue affects libcurl versions 7.12.0 through 8.19.0 and is fixed in version 8.20.0.
Affected products
- curl libcurl 7.12.0 to 8.19.0
Timeline
- 2026-04-27: disclosed: Reported to the curl project
- 2026-04-29: patched: Fixed in version 8.20.0
- 2026-04-29: advisory: Project advisory published