---
id: CVE-2026-9079
title: |-
  libcurl had a flaw that when instructed to clear proxy authentication
  credentials which made it not do so, leaving the old credentials around to get
  used for subsequent transfers that should not know nor use them.
summary: |-
  libcurl had a flaw that when instructed to clear proxy authentication
  credentials which made it not do so, leaving the old credentials around to get
  used for subsequent transfers that should not know nor use them.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-522
  - CWE-212
vendor: haxx
product: curl
affected:
  - 'curl >= 8.8.0, < 8.21.0'
patched:
  - curl 8.21.0
published: '2026-07-03'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T07:16:34.597'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-9079'
references:
  - url: 'https://curl.se/docs/CVE-2026-9079.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2026-9079.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3750295'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3750295'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9079.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-9079'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2496771'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-9079'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-9079'
  - url: 'https://access.redhat.com/errata/RHSA-2026:29017'
  - url: 'https://access.redhat.com/errata/RHSA-2026:34975'
  - url: 'https://access.redhat.com/errata/RHSA-2026:56869'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69125'
  - url: 'https://access.redhat.com/errata/RHSA-2026:72506'
  - url: 'https://access.redhat.com/errata/RHSA-2026:79357'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
  - score-dispute
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-07-06T16:49:15.639683Z'
epss: 0.01064
epssPercentile: 0.64501
scores:
  nvd: 9.8
  vendor: 7.5
ingestedAt: '2026-07-04T06:55:48.791Z'
---

## Overview

libcurl had a flaw that when instructed to clear proxy authentication
credentials which made it not do so, leaving the old credentials around to get
used for subsequent transfers that should not know nor use them.

## Affected

- `curl >= 8.8.0, < 8.21.0`

## Remediation

Upgrade past the affected range:

- `curl 8.21.0`

## Vendor advisories

- **RHSA-2026:29017** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:29017)
- **RHSA-2026:34975** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34975)
- **RHSA-2026:56869** · Red Hat · fixed in: Red Hat JBoss Core Services 2.4.62.SP5 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56869)
- **Red Hat VEX** · Moderate · affected: Confidential Compute Attestation, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat JBoss Core Services, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat JBoss Core Services, Confidential Compute Attestation, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift Container Platform 4 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9079.json)
- **RHSA-2026:69125** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69125)
- **RHSA-2026:72506** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72506)
- **RHSA-2026:79357** · Red Hat · fixed in: Red Hat Cost Management On-Premise 1 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79357)