libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHaxx Curl
APPHaxx8.8.0 – 8.21.0 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2026-11856CRITICAL9.8PL ✓same product
libcurl: błędne przekazywanie nagłówka Authorization Digest do innego hosta
CVE-2026-8924CRITICAL9.1PL ✓same product
Curl: obejście sprawdzania Public Suffix List przy parsowaniu cookies
CVE-2026-10536CRITICAL9.8PL ✓same product
Use-after-free w libcurl przy operacjach HTTP/2 stream-dependency
CVE-2026-11564CRITICAL9.1PL ✓same product
libcurl: błędna weryfikacja certyfikatu przy ponownym użyciu połączenia (CWE-295)
CVE-2026-8925CRITICAL9.8PL ✓same product
Double-free w obsłudze SASL/GSASL w Haxx Curl (CVE-2026-8925)