REDHAT-BUG-2446449: Medium severity curl curl vulnerability
Published Mar 11, 2026
·Updated
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.
Affected Software
1 affected component
curl curl
Event History
Mar 11, 2026
Data Sourced
via Red Hat·11:01 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What conditions are required for this issue to occur?
curl must reuse an existing HTTP proxy connection that is performing CONNECT, and a subsequent request must use different credentials for that same HTTP proxy.
2
Which environments are most likely to be exposed?
Environments using curl through an HTTP proxy with CONNECT requests and more than one set of proxy credentials are affected by the described connection-reuse behavior.