CVE-2026-8927
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A vulnerability in the libcurl library causes a leak of the proxy authorization header between requests. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the proxy authentication state is not cleared between requests. As a result, the `Proxy-Authorization:` header intended for one proxy may be sent to another.
Risk Assessment
The organization is at risk of leaking proxy authentication credentials, which could enable unauthorized network access or man-in-the-middle attacks. An attacker controlling the second proxy could capture credentials meant for the first proxy.
Recommendation
Immediately update the libcurl library to a version that fixes this vulnerability. Until the update is applied, avoid reusing libcurl handles with different proxy configurations or manually clear the authorization state between requests.
Original NVD description (English source)
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.