CVE-2026-3784 Details
Description
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.
A vulnerability exists in curl and libcurl versions 7.7 through 8.18.0, where the library improperly reuses an existing HTTP proxy connection that is doing CONNECT to a server. This occurs even when the new request involves different proxy credentials. The correct behavior would be to establish a new connection or use a separate one for the request with different credentials. This issue can lead to authentication bypass in scenarios where applications share a libcurl connection cache, allowing requests to be mistakenly authenticated through a reused proxy tunnel.
Users are advised to upgrade to curl and libcurl version 8.19.0, which addresses this vulnerability by restoring the proper proxy credential checks during connection reuse. Alternatively, the issue can be mitigated by avoiding the use of HTTP proxies with varying credentials.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-253495.html | siemens-SADP | |
| https://curl.se/docs/CVE-2026-3784.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-3784.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3584903 | curl | ExploitIssue TrackingThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/03/11/3 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-305 | Authentication Bypass by Primary Weakness | CISA-ADP |
| CWE-305 | Authentication Bypass by Primary Weakness | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.7, < 8.18.0 |
CPE
Remediation
| |
Change History
11 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | siemens-SADP |
| Sep 15, 2026 | CVE Modified | CVE |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | siemens-SADP |
| Jun 2, 2026 | CVE Modified | siemens-SADP |
| Mar 12, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | CVE Modified | CVE |
| Mar 11, 2026 | New CVE Received | curl |