← Vulnerability feed

Vulnerability record · CVE-2026-9079 · published 3 July 2026

CVE-2026-9079: Haxx curl insufficiently protected credentials vulnerability

Haxx · Curl

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

9.8 CVSS 3.1 Critical EPSS 0.58% · top 54.3% CWE-522 · Insufficiently protected credentials
9.8CVSS 3.1 base score
0.58%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
15 Sep 2026Last modified by NVD

Description

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://curl.se/docs/CVE-2026-9079.html PatchVendor Advisory
https://curl.se/docs/CVE-2026-9079.json Vendor Advisory
https://hackerone.com/reports/3750295 ExploitIssue TrackingThird Party Advisory
https://hackerone.com/reports/3750295 ExploitIssue TrackingThird Party Advisory

Track CVE-2026-9079 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-19931Haxx curl vulnerabilityA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is do…EPSS 0.75%9.8CVE-2026-8925Haxx curl double free vulnerabilityThe curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making…EPSS 1.1%9.8CVE-2026-10536Haxx curl use after free vulnerabilityA use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CUR…EPSS 0.60%9.8CVE-2026-11856Haxx curl authentication bypass by capture-replay vulnerabilitySuccessfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a diff…EPSS 0.69%9.8CVE-2022-32221Haxx curl information exposure vulnerabilityWhen doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOP…EPSS 4.4%9.8CVE-2022-32207Haxx curl incorrect default permissions vulnerabilityWhen curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from …EPSS 7.7%9.8CVE-2016-4606Haxx curl vulnerabilityCurl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive inform…EPSS 3.4%9.8CVE-2019-5481Haxx curl double free vulnerabilityDouble-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.EPSS 7.5%

Source: NIST National Vulnerability Database (record CVE-2026-9079), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.