curl / Docs / curl CVEs / proxy credentials leak over redirect-to proxy

CVE-2026-6253

proxy credentials leak over redirect-to proxy

Project curl Security Advisory, April 29 2026 Permalink

curl might erroneously pass on credentials for a first proxy to a second proxy.

This can happen when the following conditions are true:

curl is setup to use specific different proxies for different URL schemes
the first proxy needs credentials
the second proxy uses no credentials
while using the first proxy (using say http://), curl is asked to follow a redirect to a URL using another scheme (say https://), accessed using a second, different, proxy

The credentials are passed on base64 encoded. The receiving proxy gets no hint as for where or how the credentials are valid.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-6253 to this issue.

CWE-522: Insufficiently Protected Credentials

Severity: Medium

This flaw has existed since curl added support for credentials in proxy strings.

libcurl is used by many applications, but not always advertised as such!

This bug is not considered a C mistake. It is not likely to have been avoided had we not been using C.

This flaw also affects the curl command line tool.

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade to curl and libcurl 8.20.0

B - Apply the patch and rebuild libcurl

C - Avoid using proxies with credentials

It was reported to the curl project on April 13th 2026. We contacted distros@openwall on April 23.

libcurl 8.20.0 was released on April 29th 2026, coordinated with the publication of this advisory.

Thanks a lot!