Docs Overview
Project
Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Known Risks Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Verify Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / curl CVEs / env-set cross-proxy Digest auth state leak
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-8927

env-set cross-proxy Digest auth state leak

Project curl Security Advisory, June 24 2026 Permalink

VULNERABILITY

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

INFO

An evil proxyB could use this incoming request header field to impersonate the client in communicating with proxyA, as the header contains the authenticated state.

There is nothing in the request details passed to proxyB that reveal the name or the address of proxyA, which mitigates this problem.

This flaw is almost identical to CVE-2026-7168. The difference lies primarily in how the proxy is selected.

This bug is not considered a C mistake (likely to have been avoided had we not been using C).

This flaw does not affect the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-8927 to this issue.

CWE-294: Authentication Bypass by Capture-replay

Severity: Medium

AFFECTED VERSIONS

libcurl is used by many applications, but not always advertised as such!

SOLUTION

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 8.21.0

B - Apply the patch to your version and rebuild

C - Avoid reusing handles when changing proxies

TIMELINE

This issue was reported to the curl project on May 18, 2026.

curl 8.21.0 was released on June 24 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!