REDHAT-BUG-2496771: Medium severity libcurl vulnerability
Published Jul 3, 2026
·Updated
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
Affected Software
1 affected component
libcurl
Event History
Jul 3, 2026
Data Sourced
via Red Hat·07:02 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What conditions are required for credentials to be exposed?
The issue applies when libcurl is instructed to clear proxy authentication credentials and then performs later transfers. Because the prior credentials remain available, they may be used by transfers that should not know or use them.
2
What is the practical impact of this flaw?
Proxy authentication credentials intended to be cleared can persist and be reused on subsequent transfers. This can cause credentials to be sent or applied outside the transfer scope where they were intended.