Critical severity9.1NVD Advisory· Published Jul 3, 2026· Updated Sep 15, 2026
CVE-2026-8927
CVE-2026-8927
Description
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
19- osv-coords17 versionspkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/eco-python-curl-minimal-docpkg:apk/chainguard/eco-python-curl-nghttp2pkg:rpm/almalinux/curlpkg:rpm/almalinux/libcurl-minimalpkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/libcurl-develpkg:rpm/almalinux/curl-minimalpkg:rpm/almalinux/libcurlpkg:apk/chainguard/eco-python-curlpkg:apk/chainguard/eco-python-curl-minimalpkg:apk/chainguard/eco-python-curl-minimal-binpkg:apk/chainguard/eco-python-curl-minimal-devpkg:apk/chainguard/eco-python-curl-minimal-staticpkg:apk/chainguard/eco-python-curl-nghttp2-binpkg:apk/chainguard/eco-python-curl-nghttp2-devpkg:apk/chainguard/eco-python-curl-nghttp2-static
< 8.14.1-160000.8.1+ 16 more
- (no CPE)range: < 8.14.1-160000.8.1
- (no CPE)range: < 8.21.0-r0
- (no CPE)range: < 8.21.0-r0
- (no CPE)range: < 8.12.1-4.el10_2.4
- (no CPE)range: < 8.12.1-4.el10_2.4
- (no CPE)range: < 8.21.0-1.1
- (no CPE)range: < 8.12.1-4.el10_2.4
- (no CPE)range: < 7.76.1-40.el9_8.7
- (no CPE)range: < 8.12.1-4.el10_2.4
- (no CPE)range: < 8.21.0-r0
- (no CPE)range: < 8.21.0-r0
- (no CPE)range: < 8.21.0-r0
- (no CPE)range: < 8.21.0-r0
- (no CPE)range: < 8.21.0-r0
- (no CPE)range: < 8.21.0-r0
- (no CPE)range: < 8.21.0-r0
- (no CPE)range: < 8.21.0-r0
Patches
Vulnerability mechanics
References
3- curl.se/docs/CVE-2026-8927.htmlnvdPatchVendor Advisory
- hackerone.com/reports/3744543nvdExploitIssue TrackingThird Party Advisory
- curl.se/docs/CVE-2026-8927.jsonnvdVendor Advisory
News mentions
1- 25-Year-Old Vulnerability in cURL Used by 30 Billion Devices Finally PatchedCyber Security News · Jun 25, 2026