Executive brief
A flaw in the libcurl library, which is widely used by applications to transfer data over various protocols, fails to properly clear proxy authentication credentials when instructed to do so. This could result in sensitive login information being unintentionally reused for subsequent data transfers. In practice, this means an application might accidentally send a user's proxy password to a destination that should not have access to it.
Technical details
A vulnerability in libcurl (CWE-522) occurs when the library is instructed to clear proxy authentication credentials but fails to do so. This results in the old credentials remaining in memory and being automatically applied to subsequent transfers using the same handle. The issue affects libcurl versions 8.8.0 through 8.20.0; the curl command-line tool is not affected. Attackers could potentially receive these leaked credentials if a transfer is directed to a malicious or unauthorized proxy/endpoint. The issue is fixed in version 8.21.0.
Affected products
- curl curl 8.8.0 to 8.20.0
Timeline
- 2026-05-20: disclosed: Reported to the curl project via HackerOne.
- 2026-06-24: patched: Fixed in curl version 8.21.0.
- 2026-06-24: advisory: Project curl security advisory published.
- 2026-07-03: advisory: NVD publication date.