{"id":"CVE-2026-7168","aliases":["ALPINE-CVE-2026-7168","ALSA-2026:80512","AZL-86669","BELL-CVE-2026-7168","CLSA-2026-1779372207","CLSA-2026-1779372929","CURL-CVE-2026-7168","DEBIAN-CVE-2026-7168","EUVD-2026-29932","GHSA-v92m-hrhj-gw54","JLSEC-2026-1210","OESA-2026-2451","OESA-2026-2452","OESA-2026-2453","OESA-2026-2454","OESA-2026-2477","RHSA-2026:19106","RHSA-2026:80512","RLSA-2026:80512","ROOT-OS-DEBIAN-11-CVE-2026-7168","ROOT-OS-DEBIAN-12-CVE-2026-7168","ROOT-OS-DEBIAN-13-CVE-2026-7168","SUSE-SU-2026:23350-1","SUSE-SU-2026:23361-1","SUSE-SU-2026:23498-1","SUSE-SU-2026:23638-1","SUSE-SU-2026:3798-1","SUSE-SU-2026:3814-1","SUSE-SU-2026:3958-1","SUSE-SU-2026:4047-1","UBUNTU-CVE-2026-7168","openSUSE-SU-2026:21774-1"],"status":"published","title":"cross-proxy Digest auth state leak","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00471,"percentile":0.41017,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-294"],"published":"2026-04-29T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.14.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.14.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.11.1-7"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl-minimal","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-devel","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-minimal","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.88.1-10+deb12u15"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.20.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.20.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.20.0+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"curl","fixed_in":["7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17","7.74.0-1.3+deb11u16.root.io.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-curl","fixed_in":["7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17","7.74.0-1.3+deb11u16.root.io.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-curl","fixed_in":["7.88.1-10+deb12u14.root.io.11","7.88.1-10+deb12u14.root.io.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.24+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.25+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"curl","fixed_in":["7.81.0-1ubuntu1.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"curl","fixed_in":["8.5.0-2ubuntu10.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"curl","fixed_in":["8.14.1-2ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"curl","fixed_in":["8.18.0-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.12.0"},{"fixed":"8.14.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.12.0"},{"fixed":"8.14.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.12.0"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.12.0"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.1-7"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u15"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u11","7.88.1-10+deb12u12","7.88.1-10+deb12u13","7.88.1-10+deb12u14","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6","7.88.1-10+deb12u6~bpo11+1","7.88.1-10+deb12u7","7.88.1-10+deb12u8","7.88.1-10+deb12u9"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u4"}]}],"versions":["8.14.1-2","8.14.1-2+deb13u1","8.14.1-2+deb13u2","8.14.1-2+deb13u2~bpo13+1","8.14.1-2+deb13u3"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20.0-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1"]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.20.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.20.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-49.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-29.oe2403"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-29.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-48.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-30.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:Debian:11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"},{"fixed":"7.74.0-1.3+deb11u16.root.io.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"},{"fixed":"7.74.0-1.3+deb11u16.root.io.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u14.root.io.11"},{"fixed":"7.88.1-10+deb12u14.root.io.10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150700.7.23.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.126.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.126.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.91.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.91.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.91.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.51.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.51.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+esm10"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16","7.58.0-2ubuntu3.17","7.58.0-2ubuntu3.18","7.58.0-2ubuntu3.19","7.58.0-2ubuntu3.20","7.58.0-2ubuntu3.21","7.58.0-2ubuntu3.22","7.58.0-2ubuntu3.23","7.58.0-2ubuntu3.24","7.58.0-2ubuntu3.24+esm1","7.58.0-2ubuntu3.24+esm2","7.58.0-2ubuntu3.24+esm3","7.58.0-2ubuntu3.24+esm4","7.58.0-2ubuntu3.24+esm5","7.58.0-2ubuntu3.24+esm7","7.58.0-2ubuntu3.24+esm8","7.58.0-2ubuntu3.24+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.25+esm5"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15","7.68.0-1ubuntu2.16","7.68.0-1ubuntu2.18","7.68.0-1ubuntu2.19","7.68.0-1ubuntu2.20","7.68.0-1ubuntu2.21","7.68.0-1ubuntu2.22","7.68.0-1ubuntu2.23","7.68.0-1ubuntu2.24","7.68.0-1ubuntu2.25","7.68.0-1ubuntu2.25+esm2","7.68.0-1ubuntu2.25+esm3","7.68.0-1ubuntu2.25+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.24"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15","7.81.0-1ubuntu1.16","7.81.0-1ubuntu1.17","7.81.0-1ubuntu1.18","7.81.0-1ubuntu1.19","7.81.0-1ubuntu1.20","7.81.0-1ubuntu1.21","7.81.0-1ubuntu1.22","7.81.0-1ubuntu1.23"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.9"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6","8.5.0-2ubuntu10.7","8.5.0-2ubuntu10.8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.3"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1","8.14.1-2ubuntu1.1","8.14.1-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.1"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1","8.18.0-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-7168.json","tags":["Vendor Advisory","web","article"]},{"url":"https://curl.se/docs/CVE-2026-7168.html","tags":["Patch","Vendor Advisory","web","article"]},{"url":"https://hackerone.com/reports/3697719","tags":["exploit","Exploit","Issue Tracking","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/29/14","tags":["Mailing List","Patch","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v92m-hrhj-gw54","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-7168","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80512","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10536","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5545","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6253","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6429","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7168","tags":["report"]},{"url":"https://bugzilla.redhat.com/2461202","tags":["report"]},{"url":"https://bugzilla.redhat.com/2461204","tags":["report"]},{"url":"https://bugzilla.redhat.com/2461205","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476979","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496766","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-80512.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-7168","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779372207.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779372929.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7168.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-7168","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2451","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2452","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2453","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2454","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2477","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19106","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7009","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19106.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7009","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/29/12","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-7009.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-7009.json","tags":["article"]},{"url":"https://hackerone.com/reports/3694390","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7168","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496766","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80512.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5545","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-5545.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6253","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-6253.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6429","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-6429.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-10536.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-10536.json","tags":["article"]},{"url":"https://hackerone.com/reports/3751697","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80512","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623350-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262633","tags":["report"]},{"url":"https://bugzilla.suse.com/1263440","tags":["report"]},{"url":"https://bugzilla.suse.com/1264971","tags":["report"]},{"url":"https://bugzilla.suse.com/1268412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8926","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623361-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623498-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1277476","tags":["report"]},{"url":"https://bugzilla.suse.com/1277479","tags":["report"]},{"url":"https://bugzilla.suse.com/1277480","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80230","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623638-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263798-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262632","tags":["report"]},{"url":"https://bugzilla.suse.com/1262635","tags":["report"]},{"url":"https://bugzilla.suse.com/1262636","tags":["report"]},{"url":"https://bugzilla.suse.com/1262638","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6429","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263814-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268402","tags":["report"]},{"url":"https://bugzilla.suse.com/1268407","tags":["report"]},{"url":"https://bugzilla.suse.com/1268409","tags":["report"]},{"url":"https://bugzilla.suse.com/1268420","tags":["report"]},{"url":"https://bugzilla.suse.com/1268422","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9547","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263958-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264047-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-7168","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8227-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8525-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-7168","title":"cross-proxy Digest auth state leak","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.","status":"published","published":"2026-05-13T08:29:08.9Z","modified":"2026-09-15T06:03:07.424Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:20:05.830416Z"}],"euvd":[{"id":"EUVD-2026-29932","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.","status":"published","published":"2026-05-13T08:29:08Z","modified":"2026-09-15T06:03:07Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-v92m-hrhj-gw54","title":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest**...","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.","status":"published","published":"2026-05-13T18:30:52Z","modified":"2026-05-14T15:31:57Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:08:08.28199Z"}],"nvd":[{"id":"CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.","status":"published","published":"2026-05-13T13:01:57.2Z","modified":"2026-09-15T07:16:29.89Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"ALPINE-CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.","status":"published","published":"2026-05-13T13:01:57.2Z","modified":"2026-10-18T12:30:02.982249696Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-7168","status":"published","published":"2026-05-03T06:12:25.830118Z","modified":"2026-05-15T07:19:51.935121Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:25.50888Z"},{"id":"CVE-2026-7168","title":"cross-proxy Digest auth state leak","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.","status":"published","published":"2026-05-13T08:29:08.9Z","modified":"2026-10-28T11:22:44.622158129Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:45:15.511448Z"},{"id":"DEBIAN-CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.","status":"published","published":"2026-05-13T13:01:57.2Z","modified":"2026-10-01T03:03:39.944628909Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"JLSEC-2026-1210","title":"Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest**...","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.","status":"published","published":"2026-08-07T20:11:58.984Z","modified":"2026-08-07T20:28:40.068456374Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2451","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:19:59.385572992Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2452","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:20:00.173223473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2453","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:20:00.167468481Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2454","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:20:00.207520282Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2477","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-29T11:11:26Z","modified":"2026-08-18T01:20:00.949425098Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:19106","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-20T10:09:53Z","modified":"2026-10-15T10:14:00Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:80512","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-10-14T10:31:49Z","modified":"2026-10-15T10:28:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:80512","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253)\n\n* curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545)\n\n* curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429)\n\n* curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168)\n\n* libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-15T00:08:46.966634Z","modified":"2026-10-15T00:30:02.672952336Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-7168","title":"CVE-2026-7168 in curl - Patched by Root","description":"Root has patched CVE-2026-7168 in the curl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T12:49:54Z","modified":"2026-08-20T13:30:06.798311048Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-7168","title":"CVE-2026-7168 in rootio-curl - Patched by Root","description":"Root has patched CVE-2026-7168 in the rootio-curl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-07-09T08:22:17Z","modified":"2026-07-28T19:39:15.287861948Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-7168","title":"CVE-2026-7168 in rootio-curl - Patched by Root","description":"Root has patched CVE-2026-7168 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-07-10T15:43:44Z","modified":"2026-07-13T14:00:21.240357394Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"UBUNTU-CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.","status":"published","published":"2026-04-29T00:00:00Z","modified":"2026-07-11T00:29:32.363376976Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:03.035847Z"},{"id":"ALSA-2026:80512","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  \n\nSecurity Fix(es):  \n\n  * curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253)\n  * curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545)\n  * curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429)\n  * curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168)\n  * libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:30:08.644938407Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-86669","title":"CVE-2026-7168 affecting package curl for versions less than 8.11.1-7","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.","status":"published","published":"2026-05-13T13:01:57Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"CLSA-2026-1779372207","title":"curl: Fix of CVE-2026-7168","description":"- CVE-2026-7168: clear proxy Digest auth state when CURLOPT_PROXY is\n  reassigned to a different proxy host on the same easy handle so a stale\n  Proxy-Authorization header is not replayed to the new proxy","status":"published","published":"2026-05-22T17:52:02Z","modified":"2026-06-01T00:32:54.353018144Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779372929","title":"curl: Fix of CVE-2026-7168","description":"- CVE-2026-7168: clear proxy Digest auth state when CURLOPT_PROXY is\n  reassigned to a different proxy host on the same easy handle so a stale\n  Proxy-Authorization header is not replayed to the new proxy","status":"published","published":"2026-05-22T17:59:09Z","modified":"2026-06-01T00:32:34.247010404Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CURL-CVE-2026-7168","title":"cross-proxy Digest auth state leak","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.","status":"published","published":"2026-04-29T08:00:00Z","modified":"2026-10-25T01:05:18.974065282Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2026:21774-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).\n- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).\n","status":"published","published":"2026-09-06T16:56:18Z","modified":"2026-09-09T18:23:14.977934943Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23350-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n\nChanges for curl:\n\n- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero\n Content-Length empty body check (bsc#1264971)\n","status":"published","published":"2026-08-26T15:33:27Z","modified":"2026-09-10T18:23:12.496266156Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23361-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n\nChanges for curl:\n\n- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero\n Content-Length empty body check (bsc#1264971)\n","status":"published","published":"2026-08-26T15:41:27Z","modified":"2026-09-10T18:23:12.594530711Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23498-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).\n- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).\n","status":"published","published":"2026-09-06T16:57:12Z","modified":"2026-09-14T18:23:13.86762477Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23638-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).\n- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).\n","status":"published","published":"2026-09-06T16:57:12Z","modified":"2026-09-29T18:23:10.493555771Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3798-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n","status":"published","published":"2026-08-25T12:41:04Z","modified":"2026-08-27T11:01:49.76472582Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3814-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n","status":"published","published":"2026-08-26T10:56:35Z","modified":"2026-08-31T18:23:11.041034898Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3958-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).\n- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).\n\nChanges for curl:\n\n- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero\n Content-Length empty body check (bsc#1264971)\n","status":"published","published":"2026-09-03T13:32:12Z","modified":"2026-09-13T18:23:12.410814638Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4047-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).\n- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).\n\nChanges for curl:\n\n- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero\n Content-Length empty body check (bsc#1264971)\n","status":"published","published":"2026-09-07T13:53:51Z","modified":"2026-09-13T18:23:18.224672627Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}