REDHAT-BUG-2496771: Medium severity libcurl vulnerability

Published Jul 3, 2026

Updated

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Affected Software

1 affected component

libcurl

Event History

Jul 3, 2026

Data Sourced

via Red Hat·07:02 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for credentials to be exposed?

The issue applies when libcurl is instructed to clear proxy authentication credentials and then performs later transfers. Because the prior credentials remain available, they may be used by transfers that should not know or use them.

What is the practical impact of this flaw?

Proxy authentication credentials intended to be cleared can persist and be reused on subsequent transfers. This can cause credentials to be sent or applied outside the transfer scope where they were intended.

REDHAT-BUG-2496771: Medium severity libcurl vulnerability

Affected Software

Event History

Frequently Asked Questions

What conditions are required for credentials to be exposed?

What is the practical impact of this flaw?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for credentials to be exposed?

What is the practical impact of this flaw?