CVE-2026-9079criticalCWE-522

CVE-2026-9079: critical vulnerability in curl

stale proxy password leak

Published · Updated

Follow this CVE+ Monitor curl+ Monitor curl

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.1%
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
curl · curl
Related CVEs — curl

In the same product, most dangerous first.

CVE-2023-38545HIGHCVE-2023-38545EPSS 78.7%CVE-2023-38039HIGHCVE-2023-38039EPSS 56.2%CVE-2019-5436HIGHCVE-2019-5436EPSS 49.7%CVE-2024-2398HIGHHTTP/2 push headers memory-leakEPSS 36.1%CVE-2024-7264MEDIUMASN.1 date parser overreadEPSS 20.2%CVE-2023-38546—CVE-2023-38546EPSS 6.0%