CVE-2026-6253: proxy credentials leak over redirect-to proxy
A flaw was found in curl. When curl is configured to use specific proxies for different URL schemes, and a redirect occurs from a URL using a credentialed proxy to a URL using a non-credentialed proxy, curl may inadvertently send the credentials of the first proxy to the second. This can lead to the unauthorized disclosure of proxy credentials (CWE-522), potentially allowing an attacker to gain unauthorized access or information.
Other sources
curl might erroneously pass on credentials for a first proxy to a second proxy.
This can happen when the following conditions are true:
1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say http://), curl is asked to follow a redirect to a URL using another scheme (say https://), accessed using a second, different, proxy
— MITRE
proxy credentials leak over redirect-to proxy
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.30.3-14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6253?
CVE-2026-6253 is classified as a medium severity vulnerability due to the potential credential leakage.
How do I fix CVE-2026-6253?
To fix CVE-2026-6253, ensure that you are using the latest version of curl where this vulnerability has been addressed.
What versions of curl are affected by CVE-2026-6253?
CVE-2026-6253 affects curl versions between 7.14.1 and 8.20.0 inclusive.
What is the main risk associated with CVE-2026-6253?
The main risk associated with CVE-2026-6253 is the unintended leak of proxy credentials during redirection between proxies.
How can I mitigate the risks of CVE-2026-6253?
To mitigate the risks of CVE-2026-6253, avoid configuring multiple proxies with differing authentication requirements for the same session.