---
id: CVE-2026-6253
title: |-
  curl might erroneously pass on credentials for a first proxy to a second
  proxy.

  This can happen when the following conditions are true:

  1
summary: |-
  curl might erroneously pass on credentials for a first proxy to a second
  proxy.

  This can happen when the following conditions are true:

  1. curl is setup to use specific different proxies for different URL schemes
  2. the first proxy nee…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-522
  - CWE-201
vendor: haxx
product: curl
affected:
  - 'curl >= 7.14.1, < 8.20.0'
patched:
  - curl 8.20.0
published: '2026-05-13'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T07:16:29.073'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6253'
references:
  - url: 'https://curl.se/docs/CVE-2026-6253.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2026-6253.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3669637'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'http://www.openwall.com/lists/oss-security/2026/04/29/11'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://hackerone.com/reports/3669637'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6253.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-6253'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2461202'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-6253'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6253'
  - url: 'https://access.redhat.com/errata/RHSA-2026:12916'
  - url: 'https://access.redhat.com/errata/RHSA-2026:56869'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-13T17:42:30.813126Z'
epss: 0.00719
epssPercentile: 0.52477
ingestedAt: '2026-09-15T07:33:29.265Z'
scores:
  nvd: 5.9
  vendor: 5.3
---

## Overview

curl might erroneously pass on credentials for a first proxy to a second
proxy.

This can happen when the following conditions are true:

1. curl is setup to use specific different proxies for different URL schemes
2. the first proxy needs credentials
3. the second proxy uses no credentials
4. while using the first proxy (using say `http://`), curl is asked to follow
   a redirect to a URL using another scheme (say `https://`), accessed using a
   second, different, proxy

## Affected

- `curl >= 7.14.1, < 8.20.0`

## Remediation

Upgrade past the affected range:

- `curl 8.20.0`

## Vendor advisories

- **RHSA-2026:12916** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-05-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:12916)
- **RHSA-2026:56869** · Red Hat · fixed in: Red Hat JBoss Core Services 2.4.62.SP5 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56869)
- **Red Hat VEX** · Moderate · affected: Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · no fix planned: Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, … · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6253.json)