by Kastro
Paper/Archive/CVE-2026-8927

CVE-2026-8927

curl curl — env-set cross-proxy Digest auth state leak

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 42.9.429 × 208.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

Affected

ProductAffectedFixed inSource
curl7.12.0 – < 8.14.28.14.2CNA
curl8.15.0 – < 8.16.18.16.1CNA
curl8.17.0 – < 8.20.18.20.1CNA
curlfc6eff13b5414caf6edf22d73a3239e074a04216 – < 5c225384b8d52c67ce8259c6e4203bc57aacb5675c225384b8d52c67ce8259c6e4203bc57aacb567CNA
curl8.20.0–CNA
curl8.19.0–CNA
curl8.18.0–CNA
curl8.17.0–CNA
curl8.16.0–CNA
curl8.15.0–CNA
curl8.14.1–CNA
curl8.14.0–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refcurl.se/docs/CVE-2026-8927.jsonrefcurl.se/docs/CVE-2026-8927.htmlexploithackerone.com/reports/3744543