Vulnerability-Lookup

RHSA-2026:80512

Vulnerability from csaf_opensuse - Published: 2026-10-12 03:21 - Updated: 2026-10-30 06:48

Summary

Red Hat Security Advisory: curl security update

Severity

Moderate

Notes

Topic: An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253) * curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545) * curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429) * curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168) * libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-5545

A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-488 - Exposure of Data Element to Wrong Session

Affected products

Fixed 49 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-6253

A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-201 - Insertion of Sensitive Information Into Sent Data

Affected products

Fixed 49 products, the same list as for CVE-2026-5545

Threats

Impact Moderate

CVE-2026-6429

A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-201 - Insertion of Sensitive Information Into Sent Data

Affected products

Fixed 49 products, the same list as for CVE-2026-5545

Threats

Impact Moderate

CVE-2026-7168

A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-201 - Insertion of Sensitive Information Into Sent Data

Affected products

Fixed 49 products, the same list as for CVE-2026-5545

Threats

Impact Moderate

CVE-2026-10536

A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving `curl_easy_reset()` and `curl_easy_cleanup()`. During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS).

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 49 products, the same list as for CVE-2026-5545

Threats

Impact Moderate

References

38 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:80512	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2461202	external
https://bugzilla.redhat.com/show_bug.cgi?id=2461204	external
https://bugzilla.redhat.com/show_bug.cgi?id=2461205	external
https://bugzilla.redhat.com/show_bug.cgi?id=2476979	external
https://bugzilla.redhat.com/show_bug.cgi?id=2496766	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-5545	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461204	external
https://www.cve.org/CVERecord?id=CVE-2026-5545	external
https://nvd.nist.gov/vuln/detail/CVE-2026-5545	external
https://curl.se/docs/CVE-2026-5545.html	external
https://access.redhat.com/security/cve/CVE-2026-6253	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461202	external
https://www.cve.org/CVERecord?id=CVE-2026-6253	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6253	external
https://curl.se/docs/CVE-2026-6253.html	external
https://access.redhat.com/security/cve/CVE-2026-6429	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461205	external
https://www.cve.org/CVERecord?id=CVE-2026-6429	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6429	external
https://curl.se/docs/CVE-2026-6429.html	external
https://access.redhat.com/security/cve/CVE-2026-7168	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476979	external
https://www.cve.org/CVERecord?id=CVE-2026-7168	external
https://nvd.nist.gov/vuln/detail/CVE-2026-7168	external
http://www.openwall.com/lists/oss-security/2026/0…	external
https://curl.se/docs/CVE-2026-7168.html	external
https://curl.se/docs/CVE-2026-7168.json	external
https://hackerone.com/reports/3697719	external
https://access.redhat.com/security/cve/CVE-2026-10536	self
https://bugzilla.redhat.com/show_bug.cgi?id=2496766	external
https://www.cve.org/CVERecord?id=CVE-2026-10536	external
https://nvd.nist.gov/vuln/detail/CVE-2026-10536	external
https://curl.se/docs/CVE-2026-10536.html	external
https://curl.se/docs/CVE-2026-10536.json	external
https://hackerone.com/reports/3751697	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for curl is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253)\n\n* curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545)\n\n* curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429)\n\n* curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168)\n\n* libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:80512",
        "url": "https://access.redhat.com/errata/RHSA-2026:80512"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2461202",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461202"
      },
      {
        "category": "external",
        "summary": "2461204",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461204"
      },
      {
        "category": "external",
        "summary": "2461205",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461205"
      },
      {
        "category": "external",
        "summary": "2476979",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476979"
      },
      {
        "category": "external",
        "summary": "2496766",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496766"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80512.json"
      }
    ],
    "title": "Red Hat Security Advisory: curl security update",
    "tracking": {
      "current_release_date": "2026-10-30T06:48:31+00:00",
      "generator": {
        "date": "2026-10-30T06:48:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:80512",
      "initial_release_date": "2026-10-12T03:21:56+00:00",
      "revision_history": [
        {
          "date": "2026-10-12T03:21:56+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-12T03:21:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-30T06:48:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.2.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 10)",
                  "product_id": "BaseOS-10.2.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
                "product": {
                  "name": "libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
                  "product_id": "libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@8.12.1-4.el10_2.7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
                "product": {
                  "name": "curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
                  "product_id": "curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@8.12.1-4.el10_2.7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
                "product": {
                  "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
                  "product_id": "curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@8.12.1-4.el10_2.7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
                "product": {
                  "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
                  "product_id": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@8.12.1-4.el10_2.7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
                  "product_id": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@8.12.1-4.el10_2.7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-0:8.12.1-4.el10_2.7.aarch64",
                "product": {
                  "name": "curl-0:8.12.1-4.el10_2.7.aarch64",
                  "product_id": "curl-0:8.12.1-4.el10_2.7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.12.1-4.el10_2.7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:8.12.1-4.el10_2.7.aarch64",
                "product": {
                  "name": "libcurl-0:8.12.1-4.el10_2.7.aarch64",
                  "product_id": "libcurl-0:8.12.1-4.el10_2.7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@8.12.1-4.el10_2.7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
                "product": {
                  "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
                  "product_id": "libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.7?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
                "product": {
                  "name": "libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_id": "libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@8.12.1-4.el10_2.7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
                "product": {
                  "name": "curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_id": "curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@8.12.1-4.el10_2.7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
                "product": {
                  "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_id": "curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@8.12.1-4.el10_2.7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
                "product": {
                  "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_id": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@8.12.1-4.el10_2.7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_id": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@8.12.1-4.el10_2.7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-0:8.12.1-4.el10_2.7.ppc64le",
                "product": {
                  "name": "curl-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_id": "curl-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.12.1-4.el10_2.7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:8.12.1-4.el10_2.7.ppc64le",
                "product": {
                  "name": "libcurl-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_id": "libcurl-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@8.12.1-4.el10_2.7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
                "product": {
                  "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_id": "libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.7?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
                "product": {
                  "name": "libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
                  "product_id": "libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@8.12.1-4.el10_2.7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
                "product": {
                  "name": "curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
                  "product_id": "curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@8.12.1-4.el10_2.7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
                "product": {
                  "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
                  "product_id": "curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@8.12.1-4.el10_2.7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
                "product": {
                  "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
                  "product_id": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@8.12.1-4.el10_2.7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
                  "product_id": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@8.12.1-4.el10_2.7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-0:8.12.1-4.el10_2.7.s390x",
                "product": {
                  "name": "curl-0:8.12.1-4.el10_2.7.s390x",
                  "product_id": "curl-0:8.12.1-4.el10_2.7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.12.1-4.el10_2.7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:8.12.1-4.el10_2.7.s390x",
                "product": {
                  "name": "libcurl-0:8.12.1-4.el10_2.7.s390x",
                  "product_id": "libcurl-0:8.12.1-4.el10_2.7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@8.12.1-4.el10_2.7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
                "product": {
                  "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
                  "product_id": "libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.7?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
                "product": {
                  "name": "libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
                  "product_id": "libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@8.12.1-4.el10_2.7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
                "product": {
                  "name": "curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
                  "product_id": "curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@8.12.1-4.el10_2.7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
                "product": {
                  "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
                  "product_id": "curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@8.12.1-4.el10_2.7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
                "product": {
                  "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
                  "product_id": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@8.12.1-4.el10_2.7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
                  "product_id": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@8.12.1-4.el10_2.7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-0:8.12.1-4.el10_2.7.x86_64",
                "product": {
                  "name": "curl-0:8.12.1-4.el10_2.7.x86_64",
                  "product_id": "curl-0:8.12.1-4.el10_2.7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.12.1-4.el10_2.7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:8.12.1-4.el10_2.7.x86_64",
                "product": {
                  "name": "libcurl-0:8.12.1-4.el10_2.7.x86_64",
                  "product_id": "libcurl-0:8.12.1-4.el10_2.7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@8.12.1-4.el10_2.7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
                "product": {
                  "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
                  "product_id": "libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:8.12.1-4.el10_2.7.src",
                "product": {
                  "name": "curl-0:8.12.1-4.el10_2.7.src",
                  "product_id": "curl-0:8.12.1-4.el10_2.7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.12.1-4.el10_2.7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "curl-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "curl-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "curl-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.12.1-4.el10_2.7.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src"
        },
        "product_reference": "curl-0:8.12.1-4.el10_2.7.src",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "curl-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "libcurl-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "libcurl-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "libcurl-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "libcurl-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-5545",
      "cwe": {
        "id": "CWE-488",
        "name": "Exposure of Data Element to Wrong Session"
      },
      "discovery_date": "2026-04-23T16:35:33.607000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A flaw in libcurl allows for the wrong reuse of HTTP Negotiate authenticated connections. This can occur when an application makes an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host, potentially leading to a request being sent over a connection authenticated with unintended credentials. This issue affects applications using libcurl versions from 7.10.6 up to and including 8.19.0.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5545"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5545",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5545"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5545",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5545"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-5545.html",
          "url": "https://curl.se/docs/CVE-2026-5545.html"
        }
      ],
      "release_date": "2026-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T03:21:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:80512"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications using libcurl can disable connection reuse. This can be achieved by setting one of the following libcurl options: CURLOPT_FRESH_CONNECT to force a new connection for each request, CURLOPT_MAXCONNECTS to limit the total number of open connections, or CURLMOPT_MAX_HOST_CONNECTIONS when using the curl_multi API to limit connections per host. Disabling connection reuse may impact application performance due to increased overhead for establishing new connections.",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse"
    },
    {
      "cve": "CVE-2026-6253",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-04-23T16:35:33.623000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461202"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy\u0027s credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: This flaw in curl and libcurl allows proxy credentials to be inadvertently exposed to a second proxy during a redirect. This issue arises when curl is configured to use distinct proxies for different URL schemes, the initial proxy requires authentication, and a subsequent proxy does not. Red Hat products utilizing curl or libcurl in such a specific proxy chaining configuration may be affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6253"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461202",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461202"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6253"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-6253.html",
          "url": "https://curl.se/docs/CVE-2026-6253.html"
        }
      ],
      "release_date": "2026-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T03:21:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:80512"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid configuring curl or libcurl to use proxies that require credentials. This prevents the scenario where credentials for a first proxy could be inadvertently passed to a second proxy during a redirect.",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies"
    },
    {
      "cve": "CVE-2026-6429",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-04-23T16:35:34.628000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461205"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl. When configured to use a .netrc file for credentials and follow HTTP redirects, libcurl can inadvertently send the password from the initial connection to the redirected host. This sensitive information disclosure occurs when both the original and redirect URLs use clear text HTTP, are performed over the same HTTP proxy, and the same connection is reused. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200), could allow an attacker to obtain user credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: libcurl: Credential leak via reused proxy connection during HTTP redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A flaw in libcurl could lead to credential leakage. This issue occurs when libcurl is configured to use a `.netrc` file for credentials and follows HTTP redirects, potentially exposing passwords to the redirected host. Exploitation requires both the original and redirect URLs to be clear text HTTP, performed over the same HTTP proxy, and with connection reuse. The curl command-line tool is not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6429"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461205",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461205"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6429",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6429"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6429",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6429"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-6429.html",
          "url": "https://curl.se/docs/CVE-2026-6429.html"
        }
      ],
      "release_date": "2026-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T03:21:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:80512"
        },
        {
          "category": "workaround",
          "details": "To prevent the credential leak, avoid using the combination of .netrc for credentials, clear text HTTP URLs, and an HTTP proxy when making requests with libcurl. This operational control prevents the specific conditions that enable the vulnerability.",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: libcurl: Credential leak via reused proxy connection during HTTP redirects"
    },
    {
      "cve": "CVE-2026-7168",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-13T10:01:12.117148+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476979"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the `Proxy-Authorization` header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A flaw in libcurl allows for information disclosure when a client reuses a handle for HTTP proxy transfers. If a libcurl application uses Digest authentication with one proxy and then connects to a different proxy using the same handle, the `Proxy-Authorization` header from the initial connection may be inadvertently sent to the second proxy, potentially exposing sensitive authentication data.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-7168"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476979",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476979"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-7168",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-7168"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-7168",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7168"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/29/14",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/29/14"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-7168.html",
          "url": "https://curl.se/docs/CVE-2026-7168.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-7168.json",
          "url": "https://curl.se/docs/CVE-2026-7168.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3697719",
          "url": "https://hackerone.com/reports/3697719"
        }
      ],
      "release_date": "2026-05-13T08:29:08.900000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T03:21:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:80512"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications using libcurl should avoid reusing handles when switching between different HTTP proxies, especially after performing Digest authentication. This operational control prevents the unintended disclosure of `Proxy-Authorization` headers to subsequent proxy hosts.",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse"
    },
    {
      "cve": "CVE-2026-10536",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-07-03T07:01:35.911244+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2496766"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving `curl_easy_reset()` and `curl_easy_cleanup()`. During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact use-after-free flaw in libcurl can lead to application crashes and Denial of Service. It occurs when an application specifically configures an HTTP/2 stream-dependency tree and then performs a precise sequence of `curl_easy_reset()` and `curl_easy_cleanup()` operations, attempting to access already freed memory. This vulnerability requires a specific application programming pattern, limiting its exploitability in typical Red Hat deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10536"
        },
        {
          "category": "external",
          "summary": "RHBZ#2496766",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496766"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10536",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10536"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-10536.html",
          "url": "https://curl.se/docs/CVE-2026-10536.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-10536.json",
          "url": "https://curl.se/docs/CVE-2026-10536.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3751697",
          "url": "https://hackerone.com/reports/3751697"
        }
      ],
      "release_date": "2026-07-03T06:11:15.378000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T03:21:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:80512"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid configuring HTTP/2 stream dependencies within applications utilizing libcurl. This functionality is considered deprecated and its use is required to trigger the vulnerability.",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.7.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.7.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service"
    }
  ]
}

CVE-2026-10536 (GCVE-0-2026-10536)

Vulnerability from cvelistv5 – Published: 2026-07-03 06:11 – Updated: 2026-09-15 06:02

Title

HTTP/2 stream-dependency tree UAF

Summary

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-06 18:28 UTC

CWE

CWE-416 - Use After Free

Assigner

curl CNA under the redhat root

CNA scorecard D 46/100 over 59 records in the last 180 days details

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-10536.json
https://curl.se/docs/CVE-2026-10536.html
https://hackerone.com/reports/3751697

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.88.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.1 (semver)
curl	curl	Affected: 71b7e0161032927cdfb4e75ea40f65b8898b3956 , < bfbff7852f050232edd3e5ca5c6bf2021c340f5a (git)
curl	curl	Affected: 8.20.0 Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0

Credits

Joshua Rogers (Aisle Research) Stefan Eissing

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-10536",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T18:28:36.822614Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T18:29:27.171Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3751697"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.88.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.1",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "bfbff7852f050232edd3e5ca5c6bf2021c340f5a",
              "status": "affected",
              "version": "71b7e0161032927cdfb4e75ea40f65b8898b3956",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.20.0"
            },
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joshua Rogers (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stefan Eissing"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:36.781Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-10536.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-10536.html"
        },
        {
          "url": "https://hackerone.com/reports/3751697"
        }
      ],
      "title": "HTTP/2 stream-dependency tree UAF",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.88.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.1"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "71b7e0161032927cdfb4e75ea40f65b8898b3956"
                  },
                  {
                    "fixed": "bfbff7852f050232edd3e5ca5c6bf2021c340f5a"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.20.0",
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-10536"
        ],
        "credits": [
          {
            "name": "Joshua Rogers (Aisle Research)",
            "type": "finder"
          },
          {
            "name": "Stefan Eissing",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Use After Free",
            "id": "CWE-416"
          },
          "URL": "https://curl.se/docs/CVE-2026-10536.json",
          "affects": "lib",
          "issue": "https://hackerone.com/reports/3751697",
          "last_affected": "8.20.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2026-10536.html"
        },
        "details": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.",
        "id": "CURL-CVE-2026-10536",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-06-24T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "HTTP/2 stream-dependency tree UAF"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-10536",
    "datePublished": "2026-07-03T06:11:15.378Z",
    "dateReserved": "2026-06-01T11:49:55.548Z",
    "dateUpdated": "2026-09-15T06:02:36.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-5545 (GCVE-0-2026-5545)

Vulnerability from cvelistv5 – Published: 2026-05-13 08:27 – Updated: 2026-09-15 06:02

Title

wrong reuse of HTTP Negotiate connection

Summary

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 17:46 UTC

CWE

CWE-305 - Authentication Bypass by Primary Weakness

Assigner

curl CNA under the redhat root

CNA scorecard D 46/100 over 59 records in the last 180 days details

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-5545.json
https://curl.se/docs/CVE-2026-5545.html
https://hackerone.com/reports/3642555

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.10.6 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.0 (semver)
curl	curl	Affected: e56ae1426cb7a0a4a427cf8d6099a821fdaae428 , < 33e43985b8f3b9e66691d06e70be0395849856cd (git)
curl	curl	Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0 Affected: 7.32.0 Affected: 7.31.0 Affected: 7.30.0 Affected: 7.29.0 Affected: 7.28.1 Affected: 7.28.0 Affected: 7.27.0 Affected: 7.26.0 Affected: 7.25.0 Affected: 7.24.0 Affected: 7.23.1 Affected: 7.23.0 Affected: 7.22.0 Affected: 7.21.7 Affected: 7.21.6 Affected: 7.21.5 Affected: 7.21.4 Affected: 7.21.3 Affected: 7.21.2 Affected: 7.21.1 Affected: 7.21.0 Affected: 7.20.1 Affected: 7.20.0 Affected: 7.19.7 Affected: 7.19.6 Affected: 7.19.5 Affected: 7.19.4 Affected: 7.19.3 Affected: 7.19.2 Affected: 7.19.1 Affected: 7.19.0 Affected: 7.18.2 Affected: 7.18.1 Affected: 7.18.0 Affected: 7.17.1 Affected: 7.17.0 Affected: 7.16.4 Affected: 7.16.3 Affected: 7.16.2 Affected: 7.16.1 Affected: 7.16.0 Affected: 7.15.5 Affected: 7.15.4 Affected: 7.15.3 Affected: 7.15.2 Affected: 7.15.1 Affected: 7.15.0 Affected: 7.14.1 Affected: 7.14.0 Affected: 7.13.2 Affected: 7.13.1 Affected: 7.13.0 Affected: 7.12.3 Affected: 7.12.2 Affected: 7.12.1 Affected: 7.12.0 Affected: 7.11.2 Affected: 7.11.1 Affected: 7.11.0 Affected: 7.10.8 Affected: 7.10.7 Affected: 7.10.6

Credits

Quac Tran and Ngoc Hieu Stefan Eissing

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-5545",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T17:46:36.115262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T17:46:40.830Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3642555"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.10.6",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "33e43985b8f3b9e66691d06e70be0395849856cd",
              "status": "affected",
              "version": "e56ae1426cb7a0a4a427cf8d6099a821fdaae428",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            },
            {
              "status": "affected",
              "version": "7.44.0"
            },
            {
              "status": "affected",
              "version": "7.43.0"
            },
            {
              "status": "affected",
              "version": "7.42.1"
            },
            {
              "status": "affected",
              "version": "7.42.0"
            },
            {
              "status": "affected",
              "version": "7.41.0"
            },
            {
              "status": "affected",
              "version": "7.40.0"
            },
            {
              "status": "affected",
              "version": "7.39.0"
            },
            {
              "status": "affected",
              "version": "7.38.0"
            },
            {
              "status": "affected",
              "version": "7.37.1"
            },
            {
              "status": "affected",
              "version": "7.37.0"
            },
            {
              "status": "affected",
              "version": "7.36.0"
            },
            {
              "status": "affected",
              "version": "7.35.0"
            },
            {
              "status": "affected",
              "version": "7.34.0"
            },
            {
              "status": "affected",
              "version": "7.33.0"
            },
            {
              "status": "affected",
              "version": "7.32.0"
            },
            {
              "status": "affected",
              "version": "7.31.0"
            },
            {
              "status": "affected",
              "version": "7.30.0"
            },
            {
              "status": "affected",
              "version": "7.29.0"
            },
            {
              "status": "affected",
              "version": "7.28.1"
            },
            {
              "status": "affected",
              "version": "7.28.0"
            },
            {
              "status": "affected",
              "version": "7.27.0"
            },
            {
              "status": "affected",
              "version": "7.26.0"
            },
            {
              "status": "affected",
              "version": "7.25.0"
            },
            {
              "status": "affected",
              "version": "7.24.0"
            },
            {
              "status": "affected",
              "version": "7.23.1"
            },
            {
              "status": "affected",
              "version": "7.23.0"
            },
            {
              "status": "affected",
              "version": "7.22.0"
            },
            {
              "status": "affected",
              "version": "7.21.7"
            },
            {
              "status": "affected",
              "version": "7.21.6"
            },
            {
              "status": "affected",
              "version": "7.21.5"
            },
            {
              "status": "affected",
              "version": "7.21.4"
            },
            {
              "status": "affected",
              "version": "7.21.3"
            },
            {
              "status": "affected",
              "version": "7.21.2"
            },
            {
              "status": "affected",
              "version": "7.21.1"
            },
            {
              "status": "affected",
              "version": "7.21.0"
            },
            {
              "status": "affected",
              "version": "7.20.1"
            },
            {
              "status": "affected",
              "version": "7.20.0"
            },
            {
              "status": "affected",
              "version": "7.19.7"
            },
            {
              "status": "affected",
              "version": "7.19.6"
            },
            {
              "status": "affected",
              "version": "7.19.5"
            },
            {
              "status": "affected",
              "version": "7.19.4"
            },
            {
              "status": "affected",
              "version": "7.19.3"
            },
            {
              "status": "affected",
              "version": "7.19.2"
            },
            {
              "status": "affected",
              "version": "7.19.1"
            },
            {
              "status": "affected",
              "version": "7.19.0"
            },
            {
              "status": "affected",
              "version": "7.18.2"
            },
            {
              "status": "affected",
              "version": "7.18.1"
            },
            {
              "status": "affected",
              "version": "7.18.0"
            },
            {
              "status": "affected",
              "version": "7.17.1"
            },
            {
              "status": "affected",
              "version": "7.17.0"
            },
            {
              "status": "affected",
              "version": "7.16.4"
            },
            {
              "status": "affected",
              "version": "7.16.3"
            },
            {
              "status": "affected",
              "version": "7.16.2"
            },
            {
              "status": "affected",
              "version": "7.16.1"
            },
            {
              "status": "affected",
              "version": "7.16.0"
            },
            {
              "status": "affected",
              "version": "7.15.5"
            },
            {
              "status": "affected",
              "version": "7.15.4"
            },
            {
              "status": "affected",
              "version": "7.15.3"
            },
            {
              "status": "affected",
              "version": "7.15.2"
            },
            {
              "status": "affected",
              "version": "7.15.1"
            },
            {
              "status": "affected",
              "version": "7.15.0"
            },
            {
              "status": "affected",
              "version": "7.14.1"
            },
            {
              "status": "affected",
              "version": "7.14.0"
            },
            {
              "status": "affected",
              "version": "7.13.2"
            },
            {
              "status": "affected",
              "version": "7.13.1"
            },
            {
              "status": "affected",
              "version": "7.13.0"
            },
            {
              "status": "affected",
              "version": "7.12.3"
            },
            {
              "status": "affected",
              "version": "7.12.2"
            },
            {
              "status": "affected",
              "version": "7.12.1"
            },
            {
              "status": "affected",
              "version": "7.12.0"
            },
            {
              "status": "affected",
              "version": "7.11.2"
            },
            {
              "status": "affected",
              "version": "7.11.1"
            },
            {
              "status": "affected",
              "version": "7.11.0"
            },
            {
              "status": "affected",
              "version": "7.10.8"
            },
            {
              "status": "affected",
              "version": "7.10.7"
            },
            {
              "status": "affected",
              "version": "7.10.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Quac Tran and Ngoc Hieu"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stefan Eissing"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0027s and user2\u0027s credentials when it is in fact\nstill using the connection authenticated for user1..."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "Authentication Bypass by Primary Weakness",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:59.285Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-5545.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-5545.html"
        },
        {
          "url": "https://hackerone.com/reports/3642555"
        }
      ],
      "title": "wrong reuse of HTTP Negotiate connection",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.10.6"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "e56ae1426cb7a0a4a427cf8d6099a821fdaae428"
                  },
                  {
                    "fixed": "33e43985b8f3b9e66691d06e70be0395849856cd"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0",
              "7.45.0",
              "7.44.0",
              "7.43.0",
              "7.42.1",
              "7.42.0",
              "7.41.0",
              "7.40.0",
              "7.39.0",
              "7.38.0",
              "7.37.1",
              "7.37.0",
              "7.36.0",
              "7.35.0",
              "7.34.0",
              "7.33.0",
              "7.32.0",
              "7.31.0",
              "7.30.0",
              "7.29.0",
              "7.28.1",
              "7.28.0",
              "7.27.0",
              "7.26.0",
              "7.25.0",
              "7.24.0",
              "7.23.1",
              "7.23.0",
              "7.22.0",
              "7.21.7",
              "7.21.6",
              "7.21.5",
              "7.21.4",
              "7.21.3",
              "7.21.2",
              "7.21.1",
              "7.21.0",
              "7.20.1",
              "7.20.0",
              "7.19.7",
              "7.19.6",
              "7.19.5",
              "7.19.4",
              "7.19.3",
              "7.19.2",
              "7.19.1",
              "7.19.0",
              "7.18.2",
              "7.18.1",
              "7.18.0",
              "7.17.1",
              "7.17.0",
              "7.16.4",
              "7.16.3",
              "7.16.2",
              "7.16.1",
              "7.16.0",
              "7.15.5",
              "7.15.4",
              "7.15.3",
              "7.15.2",
              "7.15.1",
              "7.15.0",
              "7.14.1",
              "7.14.0",
              "7.13.2",
              "7.13.1",
              "7.13.0",
              "7.12.3",
              "7.12.2",
              "7.12.1",
              "7.12.0",
              "7.11.2",
              "7.11.1",
              "7.11.0",
              "7.10.8",
              "7.10.7",
              "7.10.6"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-5545"
        ],
        "credits": [
          {
            "name": "Quac Tran and Ngoc Hieu",
            "type": "finder"
          },
          {
            "name": "Stefan Eissing",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Authentication Bypass by Primary Weakness",
            "id": "CWE-305"
          },
          "URL": "https://curl.se/docs/CVE-2026-5545.json",
          "affects": "both",
          "issue": "https://hackerone.com/reports/3642555",
          "last_affected": "8.19.0",
          "package": "curl",
          "severity": "Medium",
          "www": "https://curl.se/docs/CVE-2026-5545.html"
        },
        "details": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0027s and user2\u0027s credentials when it is in fact\nstill using the connection authenticated for user1...",
        "id": "CURL-CVE-2026-5545",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-04-29T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "wrong reuse of HTTP Negotiate connection"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-5545",
    "datePublished": "2026-05-13T08:27:26.065Z",
    "dateReserved": "2026-04-04T12:10:07.125Z",
    "dateUpdated": "2026-09-15T06:02:59.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6253 (GCVE-0-2026-6253)

Vulnerability from cvelistv5 – Published: 2026-05-13 08:28 – Updated: 2026-09-15 06:03

Title

proxy credentials leak over redirect-to proxy

Summary

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 17:42 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

curl CNA under the redhat root

CNA scorecard D 46/100 over 59 records in the last 180 days details

References

4 references

URL	Tags
https://curl.se/docs/CVE-2026-6253.json
https://curl.se/docs/CVE-2026-6253.html
https://hackerone.com/reports/3669637
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.14.1 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.0 (semver)
curl	curl	Affected: 3b60bb725913ce7339aefef0a14b12df4c24db60 , < 188c2f166a20fa97c2325b2da7d0e5cecc13725f (git)
curl	curl	Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0 Affected: 7.32.0 Affected: 7.31.0 Affected: 7.30.0 Affected: 7.29.0 Affected: 7.28.1 Affected: 7.28.0 Affected: 7.27.0 Affected: 7.26.0 Affected: 7.25.0 Affected: 7.24.0 Affected: 7.23.1 Affected: 7.23.0 Affected: 7.22.0 Affected: 7.21.7 Affected: 7.21.6 Affected: 7.21.5 Affected: 7.21.4 Affected: 7.21.3 Affected: 7.21.2 Affected: 7.21.1 Affected: 7.21.0 Affected: 7.20.1 Affected: 7.20.0 Affected: 7.19.7 Affected: 7.19.6 Affected: 7.19.5 Affected: 7.19.4 Affected: 7.19.3 Affected: 7.19.2 Affected: 7.19.1 Affected: 7.19.0 Affected: 7.18.2 Affected: 7.18.1 Affected: 7.18.0 Affected: 7.17.1 Affected: 7.17.0 Affected: 7.16.4 Affected: 7.16.3 Affected: 7.16.2 Affected: 7.16.1 Affected: 7.16.0 Affected: 7.15.5 Affected: 7.15.4 Affected: 7.15.3 Affected: 7.15.2 Affected: 7.15.1 Affected: 7.15.0 Affected: 7.14.1

Credits

Dwij Mehta (O2 Lab Texas A&M University) Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-13T09:05:31.000Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/29/11"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6253",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T17:42:30.813126Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T17:42:40.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3669637"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.14.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "188c2f166a20fa97c2325b2da7d0e5cecc13725f",
              "status": "affected",
              "version": "3b60bb725913ce7339aefef0a14b12df4c24db60",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            },
            {
              "status": "affected",
              "version": "7.44.0"
            },
            {
              "status": "affected",
              "version": "7.43.0"
            },
            {
              "status": "affected",
              "version": "7.42.1"
            },
            {
              "status": "affected",
              "version": "7.42.0"
            },
            {
              "status": "affected",
              "version": "7.41.0"
            },
            {
              "status": "affected",
              "version": "7.40.0"
            },
            {
              "status": "affected",
              "version": "7.39.0"
            },
            {
              "status": "affected",
              "version": "7.38.0"
            },
            {
              "status": "affected",
              "version": "7.37.1"
            },
            {
              "status": "affected",
              "version": "7.37.0"
            },
            {
              "status": "affected",
              "version": "7.36.0"
            },
            {
              "status": "affected",
              "version": "7.35.0"
            },
            {
              "status": "affected",
              "version": "7.34.0"
            },
            {
              "status": "affected",
              "version": "7.33.0"
            },
            {
              "status": "affected",
              "version": "7.32.0"
            },
            {
              "status": "affected",
              "version": "7.31.0"
            },
            {
              "status": "affected",
              "version": "7.30.0"
            },
            {
              "status": "affected",
              "version": "7.29.0"
            },
            {
              "status": "affected",
              "version": "7.28.1"
            },
            {
              "status": "affected",
              "version": "7.28.0"
            },
            {
              "status": "affected",
              "version": "7.27.0"
            },
            {
              "status": "affected",
              "version": "7.26.0"
            },
            {
              "status": "affected",
              "version": "7.25.0"
            },
            {
              "status": "affected",
              "version": "7.24.0"
            },
            {
              "status": "affected",
              "version": "7.23.1"
            },
            {
              "status": "affected",
              "version": "7.23.0"
            },
            {
              "status": "affected",
              "version": "7.22.0"
            },
            {
              "status": "affected",
              "version": "7.21.7"
            },
            {
              "status": "affected",
              "version": "7.21.6"
            },
            {
              "status": "affected",
              "version": "7.21.5"
            },
            {
              "status": "affected",
              "version": "7.21.4"
            },
            {
              "status": "affected",
              "version": "7.21.3"
            },
            {
              "status": "affected",
              "version": "7.21.2"
            },
            {
              "status": "affected",
              "version": "7.21.1"
            },
            {
              "status": "affected",
              "version": "7.21.0"
            },
            {
              "status": "affected",
              "version": "7.20.1"
            },
            {
              "status": "affected",
              "version": "7.20.0"
            },
            {
              "status": "affected",
              "version": "7.19.7"
            },
            {
              "status": "affected",
              "version": "7.19.6"
            },
            {
              "status": "affected",
              "version": "7.19.5"
            },
            {
              "status": "affected",
              "version": "7.19.4"
            },
            {
              "status": "affected",
              "version": "7.19.3"
            },
            {
              "status": "affected",
              "version": "7.19.2"
            },
            {
              "status": "affected",
              "version": "7.19.1"
            },
            {
              "status": "affected",
              "version": "7.19.0"
            },
            {
              "status": "affected",
              "version": "7.18.2"
            },
            {
              "status": "affected",
              "version": "7.18.1"
            },
            {
              "status": "affected",
              "version": "7.18.0"
            },
            {
              "status": "affected",
              "version": "7.17.1"
            },
            {
              "status": "affected",
              "version": "7.17.0"
            },
            {
              "status": "affected",
              "version": "7.16.4"
            },
            {
              "status": "affected",
              "version": "7.16.3"
            },
            {
              "status": "affected",
              "version": "7.16.2"
            },
            {
              "status": "affected",
              "version": "7.16.1"
            },
            {
              "status": "affected",
              "version": "7.16.0"
            },
            {
              "status": "affected",
              "version": "7.15.5"
            },
            {
              "status": "affected",
              "version": "7.15.4"
            },
            {
              "status": "affected",
              "version": "7.15.3"
            },
            {
              "status": "affected",
              "version": "7.15.2"
            },
            {
              "status": "affected",
              "version": "7.15.1"
            },
            {
              "status": "affected",
              "version": "7.15.0"
            },
            {
              "status": "affected",
              "version": "7.14.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dwij Mehta (O2 Lab"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Texas A\u0026M University)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:03:02.453Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-6253.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-6253.html"
        },
        {
          "url": "https://hackerone.com/reports/3669637"
        }
      ],
      "title": "proxy credentials leak over redirect-to proxy",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.14.1"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "3b60bb725913ce7339aefef0a14b12df4c24db60"
                  },
                  {
                    "fixed": "188c2f166a20fa97c2325b2da7d0e5cecc13725f"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0",
              "7.45.0",
              "7.44.0",
              "7.43.0",
              "7.42.1",
              "7.42.0",
              "7.41.0",
              "7.40.0",
              "7.39.0",
              "7.38.0",
              "7.37.1",
              "7.37.0",
              "7.36.0",
              "7.35.0",
              "7.34.0",
              "7.33.0",
              "7.32.0",
              "7.31.0",
              "7.30.0",
              "7.29.0",
              "7.28.1",
              "7.28.0",
              "7.27.0",
              "7.26.0",
              "7.25.0",
              "7.24.0",
              "7.23.1",
              "7.23.0",
              "7.22.0",
              "7.21.7",
              "7.21.6",
              "7.21.5",
              "7.21.4",
              "7.21.3",
              "7.21.2",
              "7.21.1",
              "7.21.0",
              "7.20.1",
              "7.20.0",
              "7.19.7",
              "7.19.6",
              "7.19.5",
              "7.19.4",
              "7.19.3",
              "7.19.2",
              "7.19.1",
              "7.19.0",
              "7.18.2",
              "7.18.1",
              "7.18.0",
              "7.17.1",
              "7.17.0",
              "7.16.4",
              "7.16.3",
              "7.16.2",
              "7.16.1",
              "7.16.0",
              "7.15.5",
              "7.15.4",
              "7.15.3",
              "7.15.2",
              "7.15.1",
              "7.15.0",
              "7.14.1"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-6253"
        ],
        "credits": [
          {
            "name": "Dwij Mehta (O2 Lab",
            "type": "finder"
          },
          {
            "name": "Texas A\u0026M University)",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Insufficiently Protected Credentials",
            "id": "CWE-522"
          },
          "URL": "https://curl.se/docs/CVE-2026-6253.json",
          "affects": "both",
          "issue": "https://hackerone.com/reports/3669637",
          "last_affected": "8.19.0",
          "package": "curl",
          "severity": "Medium",
          "www": "https://curl.se/docs/CVE-2026-6253.html"
        },
        "details": "curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy",
        "id": "CURL-CVE-2026-6253",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-04-29T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "proxy credentials leak over redirect-to proxy"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-6253",
    "datePublished": "2026-05-13T08:28:03.004Z",
    "dateReserved": "2026-04-13T20:11:11.991Z",
    "dateUpdated": "2026-09-15T06:03:02.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6429 (GCVE-0-2026-6429)

Vulnerability from cvelistv5 – Published: 2026-05-13 08:28 – Updated: 2026-09-15 06:03

Title

netrc credential leak with reused proxy connection

Summary

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 14:03 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

curl CNA under the redhat root

CNA scorecard D 46/100 over 59 records in the last 180 days details

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-6429.json
https://curl.se/docs/CVE-2026-6429.html
https://hackerone.com/reports/3677759

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.14.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.0 (semver)
curl	curl	Affected: 01165e08e0d131b399fba2190f17af67e66f0888 , < b4024bf808bd558026fdc6096e8457f199ace306 (git)
curl	curl	Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0 Affected: 7.32.0 Affected: 7.31.0 Affected: 7.30.0 Affected: 7.29.0 Affected: 7.28.1 Affected: 7.28.0 Affected: 7.27.0 Affected: 7.26.0 Affected: 7.25.0 Affected: 7.24.0 Affected: 7.23.1 Affected: 7.23.0 Affected: 7.22.0 Affected: 7.21.7 Affected: 7.21.6 Affected: 7.21.5 Affected: 7.21.4 Affected: 7.21.3 Affected: 7.21.2 Affected: 7.21.1 Affected: 7.21.0 Affected: 7.20.1 Affected: 7.20.0 Affected: 7.19.7 Affected: 7.19.6 Affected: 7.19.5 Affected: 7.19.4 Affected: 7.19.3 Affected: 7.19.2 Affected: 7.19.1 Affected: 7.19.0 Affected: 7.18.2 Affected: 7.18.1 Affected: 7.18.0 Affected: 7.17.1 Affected: 7.17.0 Affected: 7.16.4 Affected: 7.16.3 Affected: 7.16.2 Affected: 7.16.1 Affected: 7.16.0 Affected: 7.15.5 Affected: 7.15.4 Affected: 7.15.3 Affected: 7.15.2 Affected: 7.15.1 Affected: 7.15.0 Affected: 7.14.1 Affected: 7.14.0

Credits

Muhamad Arga Reksapati Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T14:03:52.312824Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T14:03:55.343Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "b4024bf808bd558026fdc6096e8457f199ace306",
              "status": "affected",
              "version": "01165e08e0d131b399fba2190f17af67e66f0888",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            },
            {
              "status": "affected",
              "version": "7.44.0"
            },
            {
              "status": "affected",
              "version": "7.43.0"
            },
            {
              "status": "affected",
              "version": "7.42.1"
            },
            {
              "status": "affected",
              "version": "7.42.0"
            },
            {
              "status": "affected",
              "version": "7.41.0"
            },
            {
              "status": "affected",
              "version": "7.40.0"
            },
            {
              "status": "affected",
              "version": "7.39.0"
            },
            {
              "status": "affected",
              "version": "7.38.0"
            },
            {
              "status": "affected",
              "version": "7.37.1"
            },
            {
              "status": "affected",
              "version": "7.37.0"
            },
            {
              "status": "affected",
              "version": "7.36.0"
            },
            {
              "status": "affected",
              "version": "7.35.0"
            },
            {
              "status": "affected",
              "version": "7.34.0"
            },
            {
              "status": "affected",
              "version": "7.33.0"
            },
            {
              "status": "affected",
              "version": "7.32.0"
            },
            {
              "status": "affected",
              "version": "7.31.0"
            },
            {
              "status": "affected",
              "version": "7.30.0"
            },
            {
              "status": "affected",
              "version": "7.29.0"
            },
            {
              "status": "affected",
              "version": "7.28.1"
            },
            {
              "status": "affected",
              "version": "7.28.0"
            },
            {
              "status": "affected",
              "version": "7.27.0"
            },
            {
              "status": "affected",
              "version": "7.26.0"
            },
            {
              "status": "affected",
              "version": "7.25.0"
            },
            {
              "status": "affected",
              "version": "7.24.0"
            },
            {
              "status": "affected",
              "version": "7.23.1"
            },
            {
              "status": "affected",
              "version": "7.23.0"
            },
            {
              "status": "affected",
              "version": "7.22.0"
            },
            {
              "status": "affected",
              "version": "7.21.7"
            },
            {
              "status": "affected",
              "version": "7.21.6"
            },
            {
              "status": "affected",
              "version": "7.21.5"
            },
            {
              "status": "affected",
              "version": "7.21.4"
            },
            {
              "status": "affected",
              "version": "7.21.3"
            },
            {
              "status": "affected",
              "version": "7.21.2"
            },
            {
              "status": "affected",
              "version": "7.21.1"
            },
            {
              "status": "affected",
              "version": "7.21.0"
            },
            {
              "status": "affected",
              "version": "7.20.1"
            },
            {
              "status": "affected",
              "version": "7.20.0"
            },
            {
              "status": "affected",
              "version": "7.19.7"
            },
            {
              "status": "affected",
              "version": "7.19.6"
            },
            {
              "status": "affected",
              "version": "7.19.5"
            },
            {
              "status": "affected",
              "version": "7.19.4"
            },
            {
              "status": "affected",
              "version": "7.19.3"
            },
            {
              "status": "affected",
              "version": "7.19.2"
            },
            {
              "status": "affected",
              "version": "7.19.1"
            },
            {
              "status": "affected",
              "version": "7.19.0"
            },
            {
              "status": "affected",
              "version": "7.18.2"
            },
            {
              "status": "affected",
              "version": "7.18.1"
            },
            {
              "status": "affected",
              "version": "7.18.0"
            },
            {
              "status": "affected",
              "version": "7.17.1"
            },
            {
              "status": "affected",
              "version": "7.17.0"
            },
            {
              "status": "affected",
              "version": "7.16.4"
            },
            {
              "status": "affected",
              "version": "7.16.3"
            },
            {
              "status": "affected",
              "version": "7.16.2"
            },
            {
              "status": "affected",
              "version": "7.16.1"
            },
            {
              "status": "affected",
              "version": "7.16.0"
            },
            {
              "status": "affected",
              "version": "7.15.5"
            },
            {
              "status": "affected",
              "version": "7.15.4"
            },
            {
              "status": "affected",
              "version": "7.15.3"
            },
            {
              "status": "affected",
              "version": "7.15.2"
            },
            {
              "status": "affected",
              "version": "7.15.1"
            },
            {
              "status": "affected",
              "version": "7.15.0"
            },
            {
              "status": "affected",
              "version": "7.14.1"
            },
            {
              "status": "affected",
              "version": "7.14.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhamad Arga Reksapati"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:03:05.855Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-6429.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-6429.html"
        },
        {
          "url": "https://hackerone.com/reports/3677759"
        }
      ],
      "title": "netrc credential leak with reused proxy connection",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.14.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "01165e08e0d131b399fba2190f17af67e66f0888"
                  },
                  {
                    "fixed": "b4024bf808bd558026fdc6096e8457f199ace306"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0",
              "7.45.0",
              "7.44.0",
              "7.43.0",
              "7.42.1",
              "7.42.0",
              "7.41.0",
              "7.40.0",
              "7.39.0",
              "7.38.0",
              "7.37.1",
              "7.37.0",
              "7.36.0",
              "7.35.0",
              "7.34.0",
              "7.33.0",
              "7.32.0",
              "7.31.0",
              "7.30.0",
              "7.29.0",
              "7.28.1",
              "7.28.0",
              "7.27.0",
              "7.26.0",
              "7.25.0",
              "7.24.0",
              "7.23.1",
              "7.23.0",
              "7.22.0",
              "7.21.7",
              "7.21.6",
              "7.21.5",
              "7.21.4",
              "7.21.3",
              "7.21.2",
              "7.21.1",
              "7.21.0",
              "7.20.1",
              "7.20.0",
              "7.19.7",
              "7.19.6",
              "7.19.5",
              "7.19.4",
              "7.19.3",
              "7.19.2",
              "7.19.1",
              "7.19.0",
              "7.18.2",
              "7.18.1",
              "7.18.0",
              "7.17.1",
              "7.17.0",
              "7.16.4",
              "7.16.3",
              "7.16.2",
              "7.16.1",
              "7.16.0",
              "7.15.5",
              "7.15.4",
              "7.15.3",
              "7.15.2",
              "7.15.1",
              "7.15.0",
              "7.14.1",
              "7.14.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-6429"
        ],
        "credits": [
          {
            "name": "Muhamad Arga Reksapati",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Exposure of Sensitive Information to an Unauthorized Actor",
            "id": "CWE-200"
          },
          "URL": "https://curl.se/docs/CVE-2026-6429.json",
          "affects": "lib",
          "issue": "https://hackerone.com/reports/3677759",
          "last_affected": "8.19.0",
          "package": "curl",
          "severity": "Medium",
          "www": "https://curl.se/docs/CVE-2026-6429.html"
        },
        "details": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.",
        "id": "CURL-CVE-2026-6429",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-04-29T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "netrc credential leak with reused proxy connection"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-6429",
    "datePublished": "2026-05-13T08:28:36.166Z",
    "dateReserved": "2026-04-16T14:48:02.991Z",
    "dateUpdated": "2026-09-15T06:03:05.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-7168 (GCVE-0-2026-7168)

Vulnerability from cvelistv5 – Published: 2026-05-13 08:29 – Updated: 2026-09-15 06:03

Title

cross-proxy Digest auth state leak

Summary

Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 14:18 UTC

CWE

CWE-294 - Authentication Bypass by Capture-replay

Assigner

curl CNA under the redhat root

CNA scorecard D 46/100 over 59 records in the last 180 days details

References

4 references

URL	Tags
https://curl.se/docs/CVE-2026-7168.json
https://curl.se/docs/CVE-2026-7168.html
https://hackerone.com/reports/3697719
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.12.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.0 (semver)
curl	curl	Affected: fc6eff13b5414caf6edf22d73a3239e074a04216 , < c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 (git)
curl	curl	Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0 Affected: 7.39.0 Affected: 7.38.0 Affected: 7.37.1 Affected: 7.37.0 Affected: 7.36.0 Affected: 7.35.0 Affected: 7.34.0 Affected: 7.33.0 Affected: 7.32.0 Affected: 7.31.0 Affected: 7.30.0 Affected: 7.29.0 Affected: 7.28.1 Affected: 7.28.0 Affected: 7.27.0 Affected: 7.26.0 Affected: 7.25.0 Affected: 7.24.0 Affected: 7.23.1 Affected: 7.23.0 Affected: 7.22.0 Affected: 7.21.7 Affected: 7.21.6 Affected: 7.21.5 Affected: 7.21.4 Affected: 7.21.3 Affected: 7.21.2 Affected: 7.21.1 Affected: 7.21.0 Affected: 7.20.1 Affected: 7.20.0 Affected: 7.19.7 Affected: 7.19.6 Affected: 7.19.5 Affected: 7.19.4 Affected: 7.19.3 Affected: 7.19.2 Affected: 7.19.1 Affected: 7.19.0 Affected: 7.18.2 Affected: 7.18.1 Affected: 7.18.0 Affected: 7.17.1 Affected: 7.17.0 Affected: 7.16.4 Affected: 7.16.3 Affected: 7.16.2 Affected: 7.16.1 Affected: 7.16.0 Affected: 7.15.5 Affected: 7.15.4 Affected: 7.15.3 Affected: 7.15.2 Affected: 7.15.1 Affected: 7.15.0 Affected: 7.14.1 Affected: 7.14.0 Affected: 7.13.2 Affected: 7.13.1 Affected: 7.13.0 Affected: 7.12.3 Affected: 7.12.2 Affected: 7.12.1 Affected: 7.12.0

Credits

Muhamad Arga Reksapati Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-13T09:05:54.907Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/29/14"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-7168",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T14:18:10.734219Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T16:12:24.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3697719"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "c1cfdf59acbaf9504c4578d4cf56cdd7c8594507",
              "status": "affected",
              "version": "fc6eff13b5414caf6edf22d73a3239e074a04216",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            },
            {
              "status": "affected",
              "version": "7.44.0"
            },
            {
              "status": "affected",
              "version": "7.43.0"
            },
            {
              "status": "affected",
              "version": "7.42.1"
            },
            {
              "status": "affected",
              "version": "7.42.0"
            },
            {
              "status": "affected",
              "version": "7.41.0"
            },
            {
              "status": "affected",
              "version": "7.40.0"
            },
            {
              "status": "affected",
              "version": "7.39.0"
            },
            {
              "status": "affected",
              "version": "7.38.0"
            },
            {
              "status": "affected",
              "version": "7.37.1"
            },
            {
              "status": "affected",
              "version": "7.37.0"
            },
            {
              "status": "affected",
              "version": "7.36.0"
            },
            {
              "status": "affected",
              "version": "7.35.0"
            },
            {
              "status": "affected",
              "version": "7.34.0"
            },
            {
              "status": "affected",
              "version": "7.33.0"
            },
            {
              "status": "affected",
              "version": "7.32.0"
            },
            {
              "status": "affected",
              "version": "7.31.0"
            },
            {
              "status": "affected",
              "version": "7.30.0"
            },
            {
              "status": "affected",
              "version": "7.29.0"
            },
            {
              "status": "affected",
              "version": "7.28.1"
            },
            {
              "status": "affected",
              "version": "7.28.0"
            },
            {
              "status": "affected",
              "version": "7.27.0"
            },
            {
              "status": "affected",
              "version": "7.26.0"
            },
            {
              "status": "affected",
              "version": "7.25.0"
            },
            {
              "status": "affected",
              "version": "7.24.0"
            },
            {
              "status": "affected",
              "version": "7.23.1"
            },
            {
              "status": "affected",
              "version": "7.23.0"
            },
            {
              "status": "affected",
              "version": "7.22.0"
            },
            {
              "status": "affected",
              "version": "7.21.7"
            },
            {
              "status": "affected",
              "version": "7.21.6"
            },
            {
              "status": "affected",
              "version": "7.21.5"
            },
            {
              "status": "affected",
              "version": "7.21.4"
            },
            {
              "status": "affected",
              "version": "7.21.3"
            },
            {
              "status": "affected",
              "version": "7.21.2"
            },
            {
              "status": "affected",
              "version": "7.21.1"
            },
            {
              "status": "affected",
              "version": "7.21.0"
            },
            {
              "status": "affected",
              "version": "7.20.1"
            },
            {
              "status": "affected",
              "version": "7.20.0"
            },
            {
              "status": "affected",
              "version": "7.19.7"
            },
            {
              "status": "affected",
              "version": "7.19.6"
            },
            {
              "status": "affected",
              "version": "7.19.5"
            },
            {
              "status": "affected",
              "version": "7.19.4"
            },
            {
              "status": "affected",
              "version": "7.19.3"
            },
            {
              "status": "affected",
              "version": "7.19.2"
            },
            {
              "status": "affected",
              "version": "7.19.1"
            },
            {
              "status": "affected",
              "version": "7.19.0"
            },
            {
              "status": "affected",
              "version": "7.18.2"
            },
            {
              "status": "affected",
              "version": "7.18.1"
            },
            {
              "status": "affected",
              "version": "7.18.0"
            },
            {
              "status": "affected",
              "version": "7.17.1"
            },
            {
              "status": "affected",
              "version": "7.17.0"
            },
            {
              "status": "affected",
              "version": "7.16.4"
            },
            {
              "status": "affected",
              "version": "7.16.3"
            },
            {
              "status": "affected",
              "version": "7.16.2"
            },
            {
              "status": "affected",
              "version": "7.16.1"
            },
            {
              "status": "affected",
              "version": "7.16.0"
            },
            {
              "status": "affected",
              "version": "7.15.5"
            },
            {
              "status": "affected",
              "version": "7.15.4"
            },
            {
              "status": "affected",
              "version": "7.15.3"
            },
            {
              "status": "affected",
              "version": "7.15.2"
            },
            {
              "status": "affected",
              "version": "7.15.1"
            },
            {
              "status": "affected",
              "version": "7.15.0"
            },
            {
              "status": "affected",
              "version": "7.14.1"
            },
            {
              "status": "affected",
              "version": "7.14.0"
            },
            {
              "status": "affected",
              "version": "7.13.2"
            },
            {
              "status": "affected",
              "version": "7.13.1"
            },
            {
              "status": "affected",
              "version": "7.13.0"
            },
            {
              "status": "affected",
              "version": "7.12.3"
            },
            {
              "status": "affected",
              "version": "7.12.2"
            },
            {
              "status": "affected",
              "version": "7.12.1"
            },
            {
              "status": "affected",
              "version": "7.12.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhamad Arga Reksapati"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "Authentication Bypass by Capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:03:07.424Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-7168.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-7168.html"
        },
        {
          "url": "https://hackerone.com/reports/3697719"
        }
      ],
      "title": "cross-proxy Digest auth state leak",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.12.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "fc6eff13b5414caf6edf22d73a3239e074a04216"
                  },
                  {
                    "fixed": "c1cfdf59acbaf9504c4578d4cf56cdd7c8594507"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0",
              "7.45.0",
              "7.44.0",
              "7.43.0",
              "7.42.1",
              "7.42.0",
              "7.41.0",
              "7.40.0",
              "7.39.0",
              "7.38.0",
              "7.37.1",
              "7.37.0",
              "7.36.0",
              "7.35.0",
              "7.34.0",
              "7.33.0",
              "7.32.0",
              "7.31.0",
              "7.30.0",
              "7.29.0",
              "7.28.1",
              "7.28.0",
              "7.27.0",
              "7.26.0",
              "7.25.0",
              "7.24.0",
              "7.23.1",
              "7.23.0",
              "7.22.0",
              "7.21.7",
              "7.21.6",
              "7.21.5",
              "7.21.4",
              "7.21.3",
              "7.21.2",
              "7.21.1",
              "7.21.0",
              "7.20.1",
              "7.20.0",
              "7.19.7",
              "7.19.6",
              "7.19.5",
              "7.19.4",
              "7.19.3",
              "7.19.2",
              "7.19.1",
              "7.19.0",
              "7.18.2",
              "7.18.1",
              "7.18.0",
              "7.17.1",
              "7.17.0",
              "7.16.4",
              "7.16.3",
              "7.16.2",
              "7.16.1",
              "7.16.0",
              "7.15.5",
              "7.15.4",
              "7.15.3",
              "7.15.2",
              "7.15.1",
              "7.15.0",
              "7.14.1",
              "7.14.0",
              "7.13.2",
              "7.13.1",
              "7.13.0",
              "7.12.3",
              "7.12.2",
              "7.12.1",
              "7.12.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-7168"
        ],
        "credits": [
          {
            "name": "Muhamad Arga Reksapati",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Authentication Bypass by Capture-replay",
            "id": "CWE-294"
          },
          "URL": "https://curl.se/docs/CVE-2026-7168.json",
          "affects": "lib",
          "issue": "https://hackerone.com/reports/3697719",
          "last_affected": "8.19.0",
          "package": "curl",
          "severity": "Medium",
          "www": "https://curl.se/docs/CVE-2026-7168.html"
        },
        "details": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.",
        "id": "CURL-CVE-2026-7168",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-04-29T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "cross-proxy Digest auth state leak"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-7168",
    "datePublished": "2026-05-13T08:29:08.900Z",
    "dateReserved": "2026-04-27T07:37:37.172Z",
    "dateUpdated": "2026-09-15T06:03:07.424Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:80512

CVE-2026-10536 (GCVE-0-2026-10536)

CVE-2026-5545 (GCVE-0-2026-5545)

CVE-2026-6253 (GCVE-0-2026-6253)

CVE-2026-6429 (GCVE-0-2026-6429)

CVE-2026-7168 (GCVE-0-2026-7168)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour