CVE-2026-9079CWE-522

CVE-2026-9079

Critical · published July 3, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

libcurl had a flaw that when instructed to clear proxy authentication

credentials which made it not do so, leaving the old credentials around to get

used for subsequent transfers that should not know nor use them.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00584 · 47.2th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-07-03T11:16Z
Affected products (1)
ProductVersionsFixed in
haxx/curl≥ 8.8.0, < 8.21.08.21.0
References (4)
https://curl.se/docs/CVE-2026-9079.html · 2499f714-1537-4658-8207-48ae4bb9eae9https://curl.se/docs/CVE-2026-9079.json · 2499f714-1537-4658-8207-48ae4bb9eae9https://hackerone.com/reports/3750295 · 2499f714-1537-4658-8207-48ae4bb9eae9https://hackerone.com/reports/3750295 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 JUL 06:16Z
    stale proxy password leak
    cvelistv5