Most recent entries from all

bdu:2026-09773

BELL-CVE-2026-6253

Affected: Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl

certfr-2026-avi-0514 — De multiples vulnérabilités ont été découvertes dans Curl. Elles permettent à un attaquant de provoquer une atteinte à…

certfr-2026-avi-0514

EUVD-2026-368416

fkie_cve-2026-6253

curl might erroneously pass on credentials for a first proxy to a second proxy.

This can happen when the following conditions are true:

1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy

GHSA-6qjr-r96v-3wcx

curl might erroneously pass on credentials for a first proxy to a second proxy.

This can happen when the following conditions are true:

msrc_CVE-2026-6253 — proxy credentials leak over redirect-to proxy

msrc_CVE-2026-6253

OESA-2026-2451 — curl security update

Affected: openEuler:22.03-LTS-SP4: curl

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es):

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.(CVE-2026-4873)

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials.

An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's creden…

openSUSE-SU-2026:10674-1 — curl-8.20.0-1.1 on GA media

curl-8.20.0-1.1 on GA media

RHSA-2026:12916 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

curl: curl: Information disclosure due to incorrect TLS connection reuse curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers curl: libcurl: Credential leak via reused proxy connection during HTTP redirects

SUSE-SU-2026:1940-1 — Security update for curl

Security update for curl

UBUNTU-CVE-2026-6253

Affected: Ubuntu:Pro:14.04:LTS: curl, Ubuntu:Pro:16.04:LTS: curl, Ubuntu:Pro:18.04:LTS: curl, Ubuntu:Pro:20.04:LTS: curl, Ubuntu:22.04:LTS: curl, Ubuntu:24.04:LTS: curl, Ubuntu:25.10: curl, Ubuntu:26.04:LTS: curl

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy

WID-SEC-W-2026-1307 — cURL: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.