curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | May 20, 2026 | Mar 11, 2026 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Sep 10, 2026 | Jul 27, 2026 |
| Debian | — | Upgrade curl | Jul 12, 2026 | Jul 12, 2026 |
| Freebsd | — | Upgrade curl | Mar 12, 2026 | Mar 11, 2026 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory10 | Jun 28, 2026 | Jun 26, 2026 |
| Redhat_linux | — | No solution existsUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimalUpgrade curlUpgrade curl-debuginfoUpgrade libcurlUpgrade libcurl-debuginfoUpgrade curl-debugsourceUpgrade libcurl-devel | Jul 17, 2026 | Mar 11, 2026 |
| Suse | — | Upgrade libcurl-devel-32bitUpgrade libcurl4-32bitUpgrade libcurl-mini4Upgrade curl-zsh-completionUpgrade libcurl-devel-docUpgrade libcurl-develUpgrade curlUpgrade libcurl4Upgrade curl-fish-completion | Mar 13, 2026 | Mar 12, 2026 |
| Ubuntu | — | Upgrade libcurl3t64-gnutlsUpgrade libcurl4t64Upgrade libcurl4 (Ubuntu Pro)Upgrade libcurl3-gnutls (Ubuntu Pro)Upgrade curlUpgrade libcurl4Upgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl3-nssUpgrade libcurl3-gnutlsUpgrade curl (Ubuntu Pro) | Mar 12, 2026 | Mar 11, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub