VULNERABILITY INTELLIGENCE

CVE-2026-6253

CVSS score5.9 MEDIUM

EPSS probability0.72%

CISA KEVNot currently listed

Published2026-05-13

Last modified2026-09-15

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy

Weakness classification

2499f714-1537-4658-8207-48ae4bb9eae9: CWE-522
nvd@nist.gov: CWE-522

Primary references

2499f714-1537-4658-8207-48ae4bb9eae9 — Patch, Vendor Advisory
2499f714-1537-4658-8207-48ae4bb9eae9 — Vendor Advisory
2499f714-1537-4658-8207-48ae4bb9eae9 — Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Issue Tracking, Third Party Advisory