CVE-2026-7168: Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and…

CVE-2026-7168 · Severity: medium · CVSS 5.3 · Published 2026-05-13

A vulnerability in the libcurl library, which is widely used by applications to transfer data over the internet, could allow a malicious proxy server to steal authentication credentials. If an application uses one proxy and then switches to a second proxy while reusing the same internal connection handle, the library may mistakenly send the first proxy's login information to the second one. This could allow the operator of the second proxy to impersonate the user when communicating with the first proxy.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-7168 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7168 being exploited in the wild.
How severe is CVE-2026-7168?
Medium severity, with a CVSS score of 5.3, published 13 May 2026.
Which products and versions are affected?
curl libcurl 7.12.0 to 8.19.0.
Is there a fix for CVE-2026-7168?
A patch was published on 2026-04-29: Fixed in version 8.20.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7168 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-7168?
Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A state leak exists in libcurl's Digest authentication logic when reusing handles across different HTTP proxies. When an application performs a transfer using Digest auth through 'proxyA' and subsequently changes the proxy configuration to 'proxyB' using the same easy handle, libcurl fails to clear the authentication state. Consequently, the 'Proxy-Authorization' header intended for 'proxyA' is sent to 'proxyB'. An attacker controlling 'proxyB' could capture this header to replay authentication against 'proxyA'. This issue affects libcurl versions 7.12.0 through 8.19.0 and is fixed in version 8.20.0.

Affected products

  • curl libcurl 7.12.0 to 8.19.0

Timeline

  • 2026-04-27: disclosed: Reported to the curl project
  • 2026-04-29: patched: Fixed in version 8.20.0
  • 2026-04-29: advisory: Project advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.