oss-security - [ADVISORY] curl: CVE-2026-6253: proxy credentials leak over redirect-to proxy

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <rn98r54r-0s36-117o-685s-921n16spr1p1@unkk.fr>
Date: Wed, 29 Apr 2026 08:01:10 +0200 (CEST)
From: Daniel Stenberg <daniel@...x.se>
To: curl security announcements -- curl users <curl-users@...ts.haxx.se>, 
    curl-announce@...ts.haxx.se, libcurl hacking <curl-library@...ts.haxx.se>, 
    oss-security@...ts.openwall.com
Subject: [ADVISORY] curl: CVE-2026-6253: proxy credentials leak over redirect-to
 proxy

proxy credentials leak over redirect-to proxy
=============================================

Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-6253.html)

VULNERABILITY
-------------

curl might erroneously pass on credentials for a first proxy to a second
proxy.

This can happen when the following conditions are true:

1. curl is setup to use specific different proxies for different URL schemes
2. the first proxy needs credentials
3. the second proxy uses no credentials
4. while using the first proxy (using say `http://`), curl is asked to follow
    a redirect to a URL using another scheme (say `https://`), accessed using a
    second, different, proxy

INFO
----

The credentials are passed on base64 encoded. The receiving proxy gets no hint
as for where or how the credentials are valid.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-6253 to this issue.

CWE-522: Insufficiently Protected Credentials

Severity: Medium

AFFECTED VERSIONS
-----------------

This flaw has existed since curl added support for credentials in proxy
strings.

- Affected versions: from curl 7.14.1 to and including 8.19.0
- Not affected versions: curl < 7.14.1 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/3b60bb725913ce

libcurl is used by many applications, but not always advertised as such!

This bug is not considered a *C mistake*. It is not likely to have been
avoided had we not been using C.

This flaw **also** affects the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/188c2f166a20fa97c2325

RECOMMENDATIONS
---------------

We suggest you take one of the following actions immediately, in order of
preference:

  A - Upgrade to curl and libcurl 8.20.0

  B - Apply the patch and rebuild libcurl

  C - Avoid using proxies with credentials

TIMELINE
---------

It was reported to the curl project on April 13th 2026. We contacted
distros@...nwall on April 23.

libcurl 8.20.0 was released on April 29th 2026, coordinated with the
publication of this advisory.

CREDITS
-------

- Reported-by: Dwij Mehta
- Patched-by: Daniel Stenberg

Thanks a lot!

-- 

  / daniel.haxx.se || https://rock-solid.curl.dev

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.