What’s Vulnerable › Vulnerabilities

CVE-2026-9079: stale proxy password leak

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-03 · updated 2026-09-15
• Weakness: CWE-522

Description

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Affected products

• curl: from 8.8.0 before 8.21.0 — fixed in 8.21.0

How to fix

Upgrade to a fixed version: curl 8.21.0. Check the vendor advisory for mitigations.

References

• https://curl.se/docs/CVE-2026-9079.html
• https://curl.se/docs/CVE-2026-9079.json
• https://hackerone.com/reports/3750295
• https://hackerone.com/reports/3750295

Get alerted when CVE-2026-9079 or the next vulnerability affects your stack