CVE-2026-6253
curl might erroneously pass on credentials for a first proxy to a second proxy.
Does this matter?
Lower severity and a low EPSS score (0.72%). Track it; it rarely justifies an emergency change on its own.
Description
curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-522
- Affected
- haxx/curl
- Source
- 2499f714-1537-4658-8207-48ae4bb9eae9
References
- https://curl.se/docs/CVE-2026-6253.htmlPatch, Vendor Advisory
- https://curl.se/docs/CVE-2026-6253.jsonVendor Advisory
- https://hackerone.com/reports/3669637Exploit, Issue Tracking, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/04/29/11Mailing List, Patch, Third Party Advisory
- https://hackerone.com/reports/3669637Exploit, Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.