Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
[ADVISORY] curl: CVE-2026-6253: proxy credentials leak over redirect-to proxy
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Wed, 29 Apr 2026 08:01:10 +0200 (CEST)
proxy credentials leak over redirect-to proxy
=============================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-6253.html)
VULNERABILITY
-------------
curl might erroneously pass on credentials for a first proxy to a second
proxy.
This can happen when the following conditions are true:
1. curl is setup to use specific different proxies for different URL schemes
2. the first proxy needs credentials
3. the second proxy uses no credentials
4. while using the first proxy (using say `http://`), curl is asked to follow
a redirect to a URL using another scheme (say `https://`), accessed using a
second, different, proxy
INFO
Date: Wed, 29 Apr 2026 08:01:10 +0200 (CEST)
proxy credentials leak over redirect-to proxy
=============================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-6253.html)
VULNERABILITY
-------------
curl might erroneously pass on credentials for a first proxy to a second
proxy.
This can happen when the following conditions are true:
1. curl is setup to use specific different proxies for different URL schemes
2. the first proxy needs credentials
3. the second proxy uses no credentials
4. while using the first proxy (using say `http://`), curl is asked to follow
a redirect to a URL using another scheme (say `https://`), accessed using a
second, different, proxy
INFO
---- The credentials are passed on base64 encoded. The receiving proxy gets no hint as for where or how the credentials are valid. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-6253 to this issue. CWE-522: Insufficiently Protected Credentials Severity: Medium AFFECTED VERSIONS ----------------- This flaw has existed since curl added support for credentials in proxy strings. - Affected versions: from curl 7.14.1 to and including 8.19.0 - Not affected versions: curl < 7.14.1 and >= 8.20.0 - Introduced-in: https://github.com/curl/curl/commit/3b60bb725913ce libcurl is used by many applications, but not always advertised as such! This bug is not considered a *C mistake*. It is not likely to have been avoided had we not been using C. This flaw **also** affects the curl command line tool. SOLUTION -------- - Fixed-in: https://github.com/curl/curl/commit/188c2f166a20fa97c2325 RECOMMENDATIONS --------------- We suggest you take one of the following actions immediately, in order of preference: A - Upgrade to curl and libcurl 8.20.0 B - Apply the patch and rebuild libcurl C - Avoid using proxies with credentials TIMELINE --------- It was reported to the curl project on April 13th 2026. We contacted distros_at_openwall on April 23. libcurl 8.20.0 was released on April 29th 2026, coordinated with the publication of this advisory. CREDITS ------- - Reported-by: Dwij Mehta - Patched-by: Daniel Stenberg Thanks a lot! -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2026-04-29