CVE-2026-8927 Details
Description
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.
A vulnerability exists in curl and libcurl versions 7.12.0 through 8.20.0, where the library fails to properly clear proxy authentication states between sequential transfers when using environment-variable-based proxy settings. This issue allows authentication headers from one proxy to be inadvertently sent to another, potentially leading to unauthorized access. The problem arises when an application changes the proxy via environment variables such as 'http_proxy' or 'ALL_PROXY', leaving stale authentication data that can be exploited by a malicious proxy.
Users are advised to upgrade curl and libcurl to version 8.21.0, where this issue has been fixed. Alternatively, the patch available in the curl GitHub repository can be applied to older versions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3744543 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-8927.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-8927.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3744543 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
| CWE-294 | Authentication Bypass by Capture-replay | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.12.0, < 8.21.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | curl |