Pending AnalysisCVE-2026-6253

proxy credentials leak over redirect-to proxy

Platform

curl

Component

curl

Fixed in

8.19.1

curl might erroneously pass on credentials for a first proxy to a second proxy.

This can happen when the following conditions are true:

1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say http://), curl is asked to follow a redirect to a URL using another scheme (say https://), accessed using a second, different, proxy

Threat Intelligence

Exploit Status

Proof of ConceptUnknown
CISA KEVNO

EPSS

0.02% (4% percentile)

Affected Software

Componentcurl
Vendorcurl
Minimum version8.12.0
Maximum version8.19.0
Fixed in8.19.1

Weakness Classification (CWE)

Timeline

  1. Reserved
  2. Published
  3. EPSS updated

How to fix

Actualice a la versión 8.19.1 o superior para evitar la divulgación accidental de credenciales de proxy.  Este problema ocurre al seguir redirecciones entre diferentes esquemas de URL cuando se utilizan proxies con y sin credenciales.  Asegúrese de que su versión de cURL esté actualizada para mitigar este riesgo.

Is your project affected?

Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.

livefree scan

Try it now — no account

Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.

Manual scanSlack/email alertsContinuous monitoringWhite-label reports

Drag & drop your dependency file

composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...