CVE-2026-9079

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://curl.se/docs/CVE-2026-9079.html	Patch Vendor Advisory
https://curl.se/docs/CVE-2026-9079.json	Vendor Advisory
https://hackerone.com/reports/3750295	Exploit Issue Tracking Third Party Advisory
https://hackerone.com/reports/3750295	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

History

07 Jul 2026, 15:05

Type	Values Removed	Values Added
CWE		CWE-522
References	~~() https://curl.se/docs/CVE-2026-9079.html -~~	() https://curl.se/docs/CVE-2026-9079.html - Patch, Vendor Advisory
References	~~() https://curl.se/docs/CVE-2026-9079.json -~~	() https://curl.se/docs/CVE-2026-9079.json - Vendor Advisory
References	~~() https://hackerone.com/reports/3750295 -~~	() https://hackerone.com/reports/3750295 - Exploit, Issue Tracking, Third Party Advisory
First Time		Haxx curl Haxx
CPE		cpe:2.3:a:haxx:curl::::::::

06 Jul 2026, 18:16

Type	Values Removed	Values Added
References	~~() https://hackerone.com/reports/3750295 -~~	() https://hackerone.com/reports/3750295 -
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8

03 Jul 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-03 07:16

Updated : 2026-07-07 15:05

NVD link : CVE-2026-9079

Mitre link : CVE-2026-9079

CVE.ORG link : CVE-2026-9079

JSON object : View

Products Affected

haxx

curl

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-9079", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9079", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T16:49:15.639683Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "affectedData": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.20.0", "versionType": "semver", "lessThanOrEqual": "8.20.0"}, {"status": "affected", "version": "8.19.0", "versionType": "semver", "lessThanOrEqual": "8.19.0"}, {"status": "affected", "version": "8.18.0", "versionType": "semver", "lessThanOrEqual": "8.18.0"}, {"status": "affected", "version": "8.17.0", "versionType": "semver", "lessThanOrEqual": "8.17.0"}, {"status": "affected", "version": "8.16.0", "versionType": "semver", "lessThanOrEqual": "8.16.0"}, {"status": "affected", "version": "8.15.0", "versionType": "semver", "lessThanOrEqual": "8.15.0"}, {"status": "affected", "version": "8.14.1", "versionType": "semver", "lessThanOrEqual": "8.14.1"}, {"status": "affected", "version": "8.14.0", "versionType": "semver", "lessThanOrEqual": "8.14.0"}, {"status": "affected", "version": "8.13.0", "versionType": "semver", "lessThanOrEqual": "8.13.0"}, {"status": "affected", "version": "8.12.1", "versionType": "semver", "lessThanOrEqual": "8.12.1"}, {"status": "affected", "version": "8.12.0", "versionType": "semver", "lessThanOrEqual": "8.12.0"}, {"status": "affected", "version": "8.11.1", "versionType": "semver", "lessThanOrEqual": "8.11.1"}, {"status": "affected", "version": "8.11.0", "versionType": "semver", "lessThanOrEqual": "8.11.0"}, {"status": "affected", "version": "8.10.1", "versionType": "semver", "lessThanOrEqual": "8.10.1"}, {"status": "affected", "version": "8.10.0", "versionType": "semver", "lessThanOrEqual": "8.10.0"}, {"status": "affected", "version": "8.9.1", "versionType": "semver", "lessThanOrEqual": "8.9.1"}, {"status": "affected", "version": "8.9.0", "versionType": "semver", "lessThanOrEqual": "8.9.0"}, {"status": "affected", "version": "8.8.0", "versionType": "semver", "lessThanOrEqual": "8.8.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-03T07:16:25.620", "references": [{"url": "https://curl.se/docs/CVE-2026-9079.html", "tags": ["Patch", "Vendor Advisory"], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://curl.se/docs/CVE-2026-9079.json", "tags": ["Vendor Advisory"], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://hackerone.com/reports/3750295", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://hackerone.com/reports/3750295", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them."}], "lastModified": "2026-07-07T15:05:55.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9238ECE6-3CA5-48A9-B558-DF2BC6CE04AD", "versionEndExcluding": "8.21.0", "versionStartIncluding": "8.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9"}