{"id":"CVE-2026-9079","state":"PUBLISHED","title":"stale proxy password leak","description":"libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them.","publishedAt":"2026-07-03T06:16:51.127Z","updatedAt":"2026-09-15T06:03:28.741Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"curl","products":["curl curl"],"affected":[{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"8.8.0","status":"affected","lessThan":"8.14.2","versionType":"semver"},{"version":"8.15.0","status":"affected","lessThan":"8.16.1","versionType":"semver"},{"version":"8.17.0","status":"affected","lessThan":"8.20.1","versionType":"semver"}]},{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"d5e83eb745762f48d8fafadc5df5dd3ae8d8941e","status":"affected","lessThan":"88c7e16cceec816a2df45c899d49b1e85513f193","versionType":"git"}],"repo":"https://github.com/curl/curl.git"},{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"8.20.0","status":"affected"},{"version":"8.19.0","status":"affected"},{"version":"8.18.0","status":"affected"},{"version":"8.17.0","status":"affected"},{"version":"8.16.0","status":"affected"},{"version":"8.15.0","status":"affected"},{"version":"8.14.1","status":"affected"},{"version":"8.14.0","status":"affected"},{"version":"8.13.0","status":"affected"},{"version":"8.12.1","status":"affected"},{"version":"8.12.0","status":"affected"},{"version":"8.11.1","status":"affected"},{"version":"8.11.0","status":"affected"},{"version":"8.10.1","status":"affected"},{"version":"8.10.0","status":"affected"},{"version":"8.9.1","status":"affected"},{"version":"8.9.0","status":"affected"},{"version":"8.8.0","status":"affected"}]}],"references":["https://curl.se/docs/CVE-2026-9079.json","https://curl.se/docs/CVE-2026-9079.html","https://hackerone.com/reports/3750295"],"weaknesses":["CWE-522"],"ingestedAt":"2026-10-29T20:13:52.441Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/9xxx/CVE-2026-9079.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-9079","state":"PUBLISHED","datePublished":"2026-07-03T06:16:51.127Z","dateUpdated":"2026-09-15T06:03:28.741Z","assignerShortName":"curl","assignerOrgId":"2499f714-1537-4658-8207-48ae4bb9eae9","dateReserved":"2026-05-20T12:59:41.444Z"},"containers":{"cna":{"title":"stale proxy password leak","descriptions":[{"lang":"en","value":"libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them."}],"affected":[{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"8.8.0","status":"affected","lessThan":"8.14.2","versionType":"semver"},{"version":"8.15.0","status":"affected","lessThan":"8.16.1","versionType":"semver"},{"version":"8.17.0","status":"affected","lessThan":"8.20.1","versionType":"semver"}]},{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"d5e83eb745762f48d8fafadc5df5dd3ae8d8941e","status":"affected","lessThan":"88c7e16cceec816a2df45c899d49b1e85513f193","versionType":"git"}],"repo":"https://github.com/curl/curl.git"},{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"8.20.0","status":"affected"},{"version":"8.19.0","status":"affected"},{"version":"8.18.0","status":"affected"},{"version":"8.17.0","status":"affected"},{"version":"8.16.0","status":"affected"},{"version":"8.15.0","status":"affected"},{"version":"8.14.1","status":"affected"},{"version":"8.14.0","status":"affected"},{"version":"8.13.0","status":"affected"},{"version":"8.12.1","status":"affected"},{"version":"8.12.0","status":"affected"},{"version":"8.11.1","status":"affected"},{"version":"8.11.0","status":"affected"},{"version":"8.10.1","status":"affected"},{"version":"8.10.0","status":"affected"},{"version":"8.9.1","status":"affected"},{"version":"8.9.0","status":"affected"},{"version":"8.8.0","status":"affected"}]}],"references":[{"url":"https://curl.se/docs/CVE-2026-9079.json"},{"url":"https://curl.se/docs/CVE-2026-9079.html"},{"url":"https://hackerone.com/reports/3750295"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-522","lang":"en","description":"Insufficiently Protected Credentials","type":"CWE"}]}],"providerMetadata":{"shortName":"curl","orgId":"2499f714-1537-4658-8207-48ae4bb9eae9","dateUpdated":"2026-09-15T06:03:28.741Z"},"x_osv":{"schema_version":"1.5.0","id":"CURL-CVE-2026-9079","aliases":["CVE-2026-9079"],"summary":"stale proxy password leak","modified":"2026-09-07T10:34:51.00Z","database_specific":{"package":"curl","affects":"lib","URL":"https://curl.se/docs/CVE-2026-9079.json","www":"https://curl.se/docs/CVE-2026-9079.html","issue":"https://hackerone.com/reports/3750295","CWE":{"id":"CWE-522","desc":"Insufficiently Protected Credentials"},"last_affected":"8.20.0","severity":"Medium"},"published":"2026-06-24T08:00:00.00Z","affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.8.0"},{"fixed":"8.14.2"},{"introduced":"8.15.0"},{"fixed":"8.16.1"},{"introduced":"8.17.0"},{"fixed":"8.20.1"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"d5e83eb745762f48d8fafadc5df5dd3ae8d8941e"},{"fixed":"88c7e16cceec816a2df45c899d49b1e85513f193"}]}],"versions":["8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","8.11.1","8.11.0","8.10.1","8.10.0","8.9.1","8.9.0","8.8.0"]}],"credits":[{"name":"Guannan Wang","type":"finder"},{"name":"Zhanpeng Liu","type":"finder"},{"name":"Jiashuo Liang","type":"finder"},{"name":"Guancheng Li","type":"finder"},{"name":"Daniel Stenberg","type":"remediation developer"}],"details":"libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them."},"credits":[{"lang":"en","value":"Guannan Wang","type":"finder"},{"lang":"en","value":"Zhanpeng Liu","type":"finder"},{"lang":"en","value":"Jiashuo Liang","type":"finder"},{"lang":"en","value":"Guancheng Li","type":"finder"},{"lang":"en","value":"Daniel Stenberg","type":"remediation developer"}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://hackerone.com/reports/3750295","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-06T16:49:15.639683Z","id":"CVE-2026-9079","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-06T16:49:56.248Z"}}]}}}