by Kastro
Paper/Archive/CVE-2026-9079

CVE-2026-9079

curl curl — stale proxy password leak

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 64.7.647 × 2012.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Affected

ProductAffectedFixed inSource
curl8.8.0 – < 8.14.28.14.2CNA
curl8.15.0 – < 8.16.18.16.1CNA
curl8.17.0 – < 8.20.18.20.1CNA
curld5e83eb745762f48d8fafadc5df5dd3ae8d8941e – < 88c7e16cceec816a2df45c899d49b1e85513f19388c7e16cceec816a2df45c899d49b1e85513f193CNA
curl8.20.0–CNA
curl8.19.0–CNA
curl8.18.0–CNA
curl8.17.0–CNA
curl8.16.0–CNA
curl8.15.0–CNA
curl8.14.1–CNA
curl8.14.0–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refcurl.se/docs/CVE-2026-9079.jsonrefcurl.se/docs/CVE-2026-9079.htmlexploithackerone.com/reports/3750295