CVE-2026-6253

Wednesday, May 13, 2026

5.9

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

curl might erroneously pass on credentials for a first proxy to a second proxy.

This can happen when the following conditions are true:

curl is setup to use specific different proxies for different URL schemes
the first proxy needs credentials
the second proxy uses no credentials
while using the first proxy (using say http://), curl is asked to follow a redirect to a URL using another scheme (say https://), accessed using a second, different, proxy

Affected Software

Vendor	Product	Version Range	Status
curl	curl	`8.19.0 <= 8.19.0`	affected
curl	curl	`8.18.0 <= 8.18.0`	affected
curl	curl	`8.17.0 <= 8.17.0`	affected
curl	curl	`8.16.0 <= 8.16.0`	affected
curl	curl	`8.15.0 <= 8.15.0`	affected
curl	curl	`8.14.1 <= 8.14.1`	affected
curl	curl	`8.14.0 <= 8.14.0`	affected
curl	curl	`8.13.0 <= 8.13.0`	affected
curl	curl	`8.12.1 <= 8.12.1`	affected
curl	curl	`8.12.0 <= 8.12.0`	affected
curl	curl	`8.11.1 <= 8.11.1`	affected
curl	curl	`8.11.0 <= 8.11.0`	affected
curl	curl	`8.10.1 <= 8.10.1`	affected
curl	curl	`8.10.0 <= 8.10.0`	affected
curl	curl	`8.9.1 <= 8.9.1`	affected
curl	curl	`8.9.0 <= 8.9.0`	affected
curl	curl	`8.8.0 <= 8.8.0`	affected
curl	curl	`8.7.1 <= 8.7.1`	affected
curl	curl	`8.7.0 <= 8.7.0`	affected
curl	curl	`8.6.0 <= 8.6.0`	affected
curl	curl	`8.5.0 <= 8.5.0`	affected
curl	curl	`8.4.0 <= 8.4.0`	affected
curl	curl	`8.3.0 <= 8.3.0`	affected
curl	curl	`8.2.1 <= 8.2.1`	affected
curl	curl	`8.2.0 <= 8.2.0`	affected
curl	curl	`8.1.2 <= 8.1.2`	affected
curl	curl	`8.1.1 <= 8.1.1`	affected
curl	curl	`8.1.0 <= 8.1.0`	affected
curl	curl	`8.0.1 <= 8.0.1`	affected
curl	curl	`8.0.0 <= 8.0.0`	affected
curl	curl	`7.88.1 <= 7.88.1`	affected
curl	curl	`7.88.0 <= 7.88.0`	affected
curl	curl	`7.87.0 <= 7.87.0`	affected
curl	curl	`7.86.0 <= 7.86.0`	affected
curl	curl	`7.85.0 <= 7.85.0`	affected
curl	curl	`7.84.0 <= 7.84.0`	affected
curl	curl	`7.83.1 <= 7.83.1`	affected
curl	curl	`7.83.0 <= 7.83.0`	affected
curl	curl	`7.82.0 <= 7.82.0`	affected
curl	curl	`7.81.0 <= 7.81.0`	affected
curl	curl	`7.80.0 <= 7.80.0`	affected
curl	curl	`7.79.1 <= 7.79.1`	affected
curl	curl	`7.79.0 <= 7.79.0`	affected
curl	curl	`7.78.0 <= 7.78.0`	affected
curl	curl	`7.77.0 <= 7.77.0`	affected
curl	curl	`7.76.1 <= 7.76.1`	affected
curl	curl	`7.76.0 <= 7.76.0`	affected
curl	curl	`7.75.0 <= 7.75.0`	affected
curl	curl	`7.74.0 <= 7.74.0`	affected
curl	curl	`7.73.0 <= 7.73.0`	affected
curl	curl	`7.72.0 <= 7.72.0`	affected
curl	curl	`7.71.1 <= 7.71.1`	affected
curl	curl	`7.71.0 <= 7.71.0`	affected
curl	curl	`7.70.0 <= 7.70.0`	affected
curl	curl	`7.69.1 <= 7.69.1`	affected
curl	curl	`7.69.0 <= 7.69.0`	affected
curl	curl	`7.68.0 <= 7.68.0`	affected
curl	curl	`7.67.0 <= 7.67.0`	affected
curl	curl	`7.66.0 <= 7.66.0`	affected
curl	curl	`7.65.3 <= 7.65.3`	affected
curl	curl	`7.65.2 <= 7.65.2`	affected
curl	curl	`7.65.1 <= 7.65.1`	affected
curl	curl	`7.65.0 <= 7.65.0`	affected
curl	curl	`7.64.1 <= 7.64.1`	affected
curl	curl	`7.64.0 <= 7.64.0`	affected
curl	curl	`7.63.0 <= 7.63.0`	affected
curl	curl	`7.62.0 <= 7.62.0`	affected
curl	curl	`7.61.1 <= 7.61.1`	affected
curl	curl	`7.61.0 <= 7.61.0`	affected
curl	curl	`7.60.0 <= 7.60.0`	affected
curl	curl	`7.59.0 <= 7.59.0`	affected
curl	curl	`7.58.0 <= 7.58.0`	affected
curl	curl	`7.57.0 <= 7.57.0`	affected
curl	curl	`7.56.1 <= 7.56.1`	affected
curl	curl	`7.56.0 <= 7.56.0`	affected
curl	curl	`7.55.1 <= 7.55.1`	affected
curl	curl	`7.55.0 <= 7.55.0`	affected
curl	curl	`7.54.1 <= 7.54.1`	affected
curl	curl	`7.54.0 <= 7.54.0`	affected
curl	curl	`7.53.1 <= 7.53.1`	affected
curl	curl	`7.53.0 <= 7.53.0`	affected
curl	curl	`7.52.1 <= 7.52.1`	affected
curl	curl	`7.52.0 <= 7.52.0`	affected
curl	curl	`7.51.0 <= 7.51.0`	affected
curl	curl	`7.50.3 <= 7.50.3`	affected
curl	curl	`7.50.2 <= 7.50.2`	affected
curl	curl	`7.50.1 <= 7.50.1`	affected
curl	curl	`7.50.0 <= 7.50.0`	affected
curl	curl	`7.49.1 <= 7.49.1`	affected
curl	curl	`7.49.0 <= 7.49.0`	affected
curl	curl	`7.48.0 <= 7.48.0`	affected
curl	curl	`7.47.1 <= 7.47.1`	affected
curl	curl	`7.47.0 <= 7.47.0`	affected
curl	curl	`7.46.0 <= 7.46.0`	affected
curl	curl	`7.45.0 <= 7.45.0`	affected
curl	curl	`7.44.0 <= 7.44.0`	affected
curl	curl	`7.43.0 <= 7.43.0`	affected
curl	curl	`7.42.1 <= 7.42.1`	affected
curl	curl	`7.42.0 <= 7.42.0`	affected
curl	curl	`7.41.0 <= 7.41.0`	affected
curl	curl	`7.40.0 <= 7.40.0`	affected
curl	curl	`7.39.0 <= 7.39.0`	affected
curl	curl	`7.38.0 <= 7.38.0`	affected
curl	curl	`7.37.1 <= 7.37.1`	affected
curl	curl	`7.37.0 <= 7.37.0`	affected
curl	curl	`7.36.0 <= 7.36.0`	affected
curl	curl	`7.35.0 <= 7.35.0`	affected
curl	curl	`7.34.0 <= 7.34.0`	affected
curl	curl	`7.33.0 <= 7.33.0`	affected
curl	curl	`7.32.0 <= 7.32.0`	affected
curl	curl	`7.31.0 <= 7.31.0`	affected
curl	curl	`7.30.0 <= 7.30.0`	affected
curl	curl	`7.29.0 <= 7.29.0`	affected
curl	curl	`7.28.1 <= 7.28.1`	affected
curl	curl	`7.28.0 <= 7.28.0`	affected
curl	curl	`7.27.0 <= 7.27.0`	affected
curl	curl	`7.26.0 <= 7.26.0`	affected
curl	curl	`7.25.0 <= 7.25.0`	affected
curl	curl	`7.24.0 <= 7.24.0`	affected
curl	curl	`7.23.1 <= 7.23.1`	affected
curl	curl	`7.23.0 <= 7.23.0`	affected
curl	curl	`7.22.0 <= 7.22.0`	affected
curl	curl	`7.21.7 <= 7.21.7`	affected
curl	curl	`7.21.6 <= 7.21.6`	affected
curl	curl	`7.21.5 <= 7.21.5`	affected
curl	curl	`7.21.4 <= 7.21.4`	affected
curl	curl	`7.21.3 <= 7.21.3`	affected
curl	curl	`7.21.2 <= 7.21.2`	affected
curl	curl	`7.21.1 <= 7.21.1`	affected
curl	curl	`7.21.0 <= 7.21.0`	affected
curl	curl	`7.20.1 <= 7.20.1`	affected
curl	curl	`7.20.0 <= 7.20.0`	affected
curl	curl	`7.19.7 <= 7.19.7`	affected
curl	curl	`7.19.6 <= 7.19.6`	affected
curl	curl	`7.19.5 <= 7.19.5`	affected
curl	curl	`7.19.4 <= 7.19.4`	affected
curl	curl	`7.19.3 <= 7.19.3`	affected
curl	curl	`7.19.2 <= 7.19.2`	affected
curl	curl	`7.19.1 <= 7.19.1`	affected
curl	curl	`7.19.0 <= 7.19.0`	affected
curl	curl	`7.18.2 <= 7.18.2`	affected
curl	curl	`7.18.1 <= 7.18.1`	affected
curl	curl	`7.18.0 <= 7.18.0`	affected
curl	curl	`7.17.1 <= 7.17.1`	affected
curl	curl	`7.17.0 <= 7.17.0`	affected
curl	curl	`7.16.4 <= 7.16.4`	affected
curl	curl	`7.16.3 <= 7.16.3`	affected
curl	curl	`7.16.2 <= 7.16.2`	affected
curl	curl	`7.16.1 <= 7.16.1`	affected
curl	curl	`7.16.0 <= 7.16.0`	affected
curl	curl	`7.15.5 <= 7.15.5`	affected
curl	curl	`7.15.4 <= 7.15.4`	affected
curl	curl	`7.15.3 <= 7.15.3`	affected
curl	curl	`7.15.2 <= 7.15.2`	affected
curl	curl	`7.15.1 <= 7.15.1`	affected
curl	curl	`7.15.0 <= 7.15.0`	affected
curl	curl	`7.14.1 <= 7.14.1`	affected

Weaknesses

CWE-522 Insufficiently Protected Credentials

ADP Enrichment

CVE Program Container

Additional References

http://www.openwall.com/lists/oss-security/2026/04/29/11

CISA ADP Vulnrichment

SSVC:
Exploitation: poc
- Automatable: no
- Technical Impact: partial

Additional References

https://hackerone.com/reports/3669637

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.