CVE detail
CVE-2026-6253
curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 17.9 · diversity 16.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
5 source links · newest first
Information published.
vendormsrc.microsoft.comMay 19, 2026, 8:46 AM- http://www.openwall.com/lists/oss-security/2026/04/29/11www.openwall.com
No excerpt available.
Exploitwww.openwall.comMay 13, 2026, 1:01 PM - https://hackerone.com/reports/3669637hackerone.com
No excerpt available.
Exploithackerone.comMay 13, 2026, 1:01 PM No excerpt available.
Vendor Advisorycurl.seMay 13, 2026, 1:01 PMNo excerpt available.
Vendor Advisorycurl.seMay 13, 2026, 1:01 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-9079CVSS 9.8 · Critical
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers…
- CVE-2026-8926CVSS 9.1 · Critical
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://[email protected]/`, curl could…
- CVE-2026-3783CVSS 5.3 · Medium
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some ci…
- CVE-2022-27776CVSS 6.5 · Medium
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port nu…
- CVE-2022-27774CVSS 5.7 · Medium
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows H…
- CVE-2021-22923CVSS 5.3 · Medium
When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequ…