ByteOS Network

Vulnerability Details :

CVE-2026-6253

Assigner-curl

Assigner Org ID-2499f714-1537-4658-8207-48ae4bb9eae9

Published At-13 May, 2026 | 08:28

Updated At-13 May, 2026 | 17:42

proxy credentials leak over redirect-to proxy

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:curl

Assigner Org ID:2499f714-1537-4658-8207-48ae4bb9eae9

Published At:13 May, 2026 | 08:28

Updated At:13 May, 2026 | 17:42

▼CVE Numbering Authority (CNA)

proxy credentials leak over redirect-to proxy

Affected Products

Vendor

CURL

Product

curl

Default Status

unaffected

Versions

Affected

From 8.19.0 through 8.19.0 (semver)
From 8.18.0 through 8.18.0 (semver)
From 8.17.0 through 8.17.0 (semver)
From 8.16.0 through 8.16.0 (semver)
From 8.15.0 through 8.15.0 (semver)
From 8.14.1 through 8.14.1 (semver)
From 8.14.0 through 8.14.0 (semver)
From 8.13.0 through 8.13.0 (semver)
From 8.12.1 through 8.12.1 (semver)
From 8.12.0 through 8.12.0 (semver)
From 8.11.1 through 8.11.1 (semver)
From 8.11.0 through 8.11.0 (semver)
From 8.10.1 through 8.10.1 (semver)
From 8.10.0 through 8.10.0 (semver)
From 8.9.1 through 8.9.1 (semver)
From 8.9.0 through 8.9.0 (semver)
From 8.8.0 through 8.8.0 (semver)
From 8.7.1 through 8.7.1 (semver)
From 8.7.0 through 8.7.0 (semver)
From 8.6.0 through 8.6.0 (semver)
From 8.5.0 through 8.5.0 (semver)
From 8.4.0 through 8.4.0 (semver)
From 8.3.0 through 8.3.0 (semver)
From 8.2.1 through 8.2.1 (semver)
From 8.2.0 through 8.2.0 (semver)
From 8.1.2 through 8.1.2 (semver)
From 8.1.1 through 8.1.1 (semver)
From 8.1.0 through 8.1.0 (semver)
From 8.0.1 through 8.0.1 (semver)
From 8.0.0 through 8.0.0 (semver)
From 7.88.1 through 7.88.1 (semver)
From 7.88.0 through 7.88.0 (semver)
From 7.87.0 through 7.87.0 (semver)
From 7.86.0 through 7.86.0 (semver)
From 7.85.0 through 7.85.0 (semver)
From 7.84.0 through 7.84.0 (semver)
From 7.83.1 through 7.83.1 (semver)
From 7.83.0 through 7.83.0 (semver)
From 7.82.0 through 7.82.0 (semver)
From 7.81.0 through 7.81.0 (semver)
From 7.80.0 through 7.80.0 (semver)
From 7.79.1 through 7.79.1 (semver)
From 7.79.0 through 7.79.0 (semver)
From 7.78.0 through 7.78.0 (semver)
From 7.77.0 through 7.77.0 (semver)
From 7.76.1 through 7.76.1 (semver)
From 7.76.0 through 7.76.0 (semver)
From 7.75.0 through 7.75.0 (semver)
From 7.74.0 through 7.74.0 (semver)
From 7.73.0 through 7.73.0 (semver)
From 7.72.0 through 7.72.0 (semver)
From 7.71.1 through 7.71.1 (semver)
From 7.71.0 through 7.71.0 (semver)
From 7.70.0 through 7.70.0 (semver)
From 7.69.1 through 7.69.1 (semver)
From 7.69.0 through 7.69.0 (semver)
From 7.68.0 through 7.68.0 (semver)
From 7.67.0 through 7.67.0 (semver)
From 7.66.0 through 7.66.0 (semver)
From 7.65.3 through 7.65.3 (semver)
From 7.65.2 through 7.65.2 (semver)
From 7.65.1 through 7.65.1 (semver)
From 7.65.0 through 7.65.0 (semver)
From 7.64.1 through 7.64.1 (semver)
From 7.64.0 through 7.64.0 (semver)
From 7.63.0 through 7.63.0 (semver)
From 7.62.0 through 7.62.0 (semver)
From 7.61.1 through 7.61.1 (semver)
From 7.61.0 through 7.61.0 (semver)
From 7.60.0 through 7.60.0 (semver)
From 7.59.0 through 7.59.0 (semver)
From 7.58.0 through 7.58.0 (semver)
From 7.57.0 through 7.57.0 (semver)
From 7.56.1 through 7.56.1 (semver)
From 7.56.0 through 7.56.0 (semver)
From 7.55.1 through 7.55.1 (semver)
From 7.55.0 through 7.55.0 (semver)
From 7.54.1 through 7.54.1 (semver)
From 7.54.0 through 7.54.0 (semver)
From 7.53.1 through 7.53.1 (semver)
From 7.53.0 through 7.53.0 (semver)
From 7.52.1 through 7.52.1 (semver)
From 7.52.0 through 7.52.0 (semver)
From 7.51.0 through 7.51.0 (semver)
From 7.50.3 through 7.50.3 (semver)
From 7.50.2 through 7.50.2 (semver)
From 7.50.1 through 7.50.1 (semver)
From 7.50.0 through 7.50.0 (semver)
From 7.49.1 through 7.49.1 (semver)
From 7.49.0 through 7.49.0 (semver)
From 7.48.0 through 7.48.0 (semver)
From 7.47.1 through 7.47.1 (semver)
From 7.47.0 through 7.47.0 (semver)
From 7.46.0 through 7.46.0 (semver)
From 7.45.0 through 7.45.0 (semver)
From 7.44.0 through 7.44.0 (semver)
From 7.43.0 through 7.43.0 (semver)
From 7.42.1 through 7.42.1 (semver)
From 7.42.0 through 7.42.0 (semver)
From 7.41.0 through 7.41.0 (semver)
From 7.40.0 through 7.40.0 (semver)
From 7.39.0 through 7.39.0 (semver)
From 7.38.0 through 7.38.0 (semver)
From 7.37.1 through 7.37.1 (semver)
From 7.37.0 through 7.37.0 (semver)
From 7.36.0 through 7.36.0 (semver)
From 7.35.0 through 7.35.0 (semver)
From 7.34.0 through 7.34.0 (semver)
From 7.33.0 through 7.33.0 (semver)
From 7.32.0 through 7.32.0 (semver)
From 7.31.0 through 7.31.0 (semver)
From 7.30.0 through 7.30.0 (semver)
From 7.29.0 through 7.29.0 (semver)
From 7.28.1 through 7.28.1 (semver)
From 7.28.0 through 7.28.0 (semver)
From 7.27.0 through 7.27.0 (semver)
From 7.26.0 through 7.26.0 (semver)
From 7.25.0 through 7.25.0 (semver)
From 7.24.0 through 7.24.0 (semver)
From 7.23.1 through 7.23.1 (semver)
From 7.23.0 through 7.23.0 (semver)
From 7.22.0 through 7.22.0 (semver)
From 7.21.7 through 7.21.7 (semver)
From 7.21.6 through 7.21.6 (semver)
From 7.21.5 through 7.21.5 (semver)
From 7.21.4 through 7.21.4 (semver)
From 7.21.3 through 7.21.3 (semver)
From 7.21.2 through 7.21.2 (semver)
From 7.21.1 through 7.21.1 (semver)
From 7.21.0 through 7.21.0 (semver)
From 7.20.1 through 7.20.1 (semver)
From 7.20.0 through 7.20.0 (semver)
From 7.19.7 through 7.19.7 (semver)
From 7.19.6 through 7.19.6 (semver)
From 7.19.5 through 7.19.5 (semver)
From 7.19.4 through 7.19.4 (semver)
From 7.19.3 through 7.19.3 (semver)
From 7.19.2 through 7.19.2 (semver)
From 7.19.1 through 7.19.1 (semver)
From 7.19.0 through 7.19.0 (semver)
From 7.18.2 through 7.18.2 (semver)
From 7.18.1 through 7.18.1 (semver)
From 7.18.0 through 7.18.0 (semver)
From 7.17.1 through 7.17.1 (semver)
From 7.17.0 through 7.17.0 (semver)
From 7.16.4 through 7.16.4 (semver)
From 7.16.3 through 7.16.3 (semver)
From 7.16.2 through 7.16.2 (semver)
From 7.16.1 through 7.16.1 (semver)
From 7.16.0 through 7.16.0 (semver)
From 7.15.5 through 7.15.5 (semver)
From 7.15.4 through 7.15.4 (semver)
From 7.15.3 through 7.15.3 (semver)
From 7.15.2 through 7.15.2 (semver)
From 7.15.1 through 7.15.1 (semver)
From 7.15.0 through 7.15.0 (semver)
From 7.14.1 through 7.14.1 (semver)

Problem Types

Type	CWE ID	Description
N/A	N/A	CWE-522 Insufficiently Protected Credentials

Type: N/A

CWE ID: N/A

Description: CWE-522 Insufficiently Protected Credentials

Credits

finder

Dwij Mehta (O2 Lab

finder

Texas A&M University)

remediation developer

Daniel Stenberg

References

Hyperlink	Resource
https://curl.se/docs/CVE-2026-6253.json	N/A
https://curl.se/docs/CVE-2026-6253.html	N/A
https://hackerone.com/reports/3669637	N/A

Hyperlink: https://curl.se/docs/CVE-2026-6253.json

Resource: N/A

Hyperlink: https://curl.se/docs/CVE-2026-6253.html

Resource: N/A

Hyperlink: https://hackerone.com/reports/3669637

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://www.openwall.com/lists/oss-security/2026/04/29/11	N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2026/04/29/11

Resource: N/A

2. CISA ADP Vulnrichment

Metrics

Version	Base score	Base severity	Vector
3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Metrics Other Info

References

Hyperlink	Resource
https://hackerone.com/reports/3669637	exploit

Hyperlink: https://hackerone.com/reports/3669637

Resource:

exploit

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:2499f714-1537-4658-8207-48ae4bb9eae9

Published At:13 May, 2026 | 13:01

Updated At:14 May, 2026 | 13:40

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Secondary

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CPE Matches

CURL

>>curl>>Versions from 7.14.1(inclusive) to 8.20.0(exclusive)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-522	Primary	nvd@nist.gov

CWE ID: CWE-522

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://curl.se/docs/CVE-2026-6253.html	2499f714-1537-4658-8207-48ae4bb9eae9	Patch Vendor Advisory
https://curl.se/docs/CVE-2026-6253.json	2499f714-1537-4658-8207-48ae4bb9eae9	Vendor Advisory
https://hackerone.com/reports/3669637	2499f714-1537-4658-8207-48ae4bb9eae9	Exploit Issue Tracking Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/04/29/11	af854a3a-2127-422b-91ae-364da2661108	Mailing List Patch Third Party Advisory
https://hackerone.com/reports/3669637	134c704f-9b21-4f2e-91b3-4a467353bcc0	Exploit Issue Tracking Third Party Advisory

Hyperlink: https://curl.se/docs/CVE-2026-6253.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Patch

Vendor Advisory

Hyperlink: https://curl.se/docs/CVE-2026-6253.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Vendor Advisory

Hyperlink: https://hackerone.com/reports/3669637

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Exploit

Issue Tracking

Third Party Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2026/04/29/11

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Patch

Third Party Advisory

Hyperlink: https://hackerone.com/reports/3669637

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

Exploit

Issue Tracking

Third Party Advisory

Similar CVEs

7Records found

CVE-2023-28320

Matching Score-8

Assigner-HackerOne

View Details

Matching Score-8

Assigner-HackerOne

CVSS Score-5.9||MEDIUM

EPSS-0.64% / 70.83%

7 Day CHG~0.00%

Published-26 May, 2023 | 00:00

Updated-15 Jan, 2025 | 16:15

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

Vendor-n/a NetApp, Inc.Apple Inc.CURL

Product-h410s_firmware h410s curl h500s_firmware h700s_firmware ontap_antivirus_connector macos h300s_firmware clustered_data_ontap h700s h500s h300s https://github.com/curl/curl

CWE ID-CWE-400

Uncontrolled Resource Consumption

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2023-27537

Matching Score-8

Assigner-HackerOne

View Details

Matching Score-8

Assigner-HackerOne

CVSS Score-5.9||MEDIUM

EPSS-0.07% / 21.65%

7 Day CHG~0.00%

Published-30 Mar, 2023 | 00:00

Updated-02 Aug, 2024 | 12:16

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

Vendor-n/a NetApp, Inc.Broadcom Inc.Splunk LLC (Cisco Systems, Inc.)CURL

Product-libcurl clustered_data_ontap universal_forwarder h500s h410s_firmware h700s_firmware h300s_firmware active_iq_unified_manager h500s_firmware h410s h300s h700s brocade_fabric_operating_system_firmware https://github.com/curl/curl

CWE ID-CWE-415

Double Free

CVE-2022-43552

Matching Score-8

Assigner-HackerOne

View Details

Matching Score-8

Assigner-HackerOne

CVSS Score-5.9||MEDIUM

EPSS-0.10% / 27.82%

7 Day CHG~0.00%

Published-09 Feb, 2023 | 00:00

Updated-27 Oct, 2024 | 15:35

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Vendor-n/a Splunk LLC (Cisco Systems, Inc.)Apple Inc.CURL

Product-curl universal_forwarder macos https://github.com/curl/curl

CWE ID-CWE-416

Use After Free

CVE-2022-27776

Matching Score-6

Assigner-HackerOne

View Details

Matching Score-6

Assigner-HackerOne

CVSS Score-6.5||MEDIUM

EPSS-0.68% / 71.84%

7 Day CHG~0.00%

Published-01 Jun, 2022 | 00:00

Updated-20 Nov, 2024 | 15:23

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

Vendor-n/a NetApp, Inc.Debian GNU/Linux Splunk LLC (Cisco Systems, Inc.)CURL Fedora Project Brocade Communications Systems, Inc. (Broadcom Inc.)

Product-h500s solidfire_\&_hci_management_node h300s_firmware hci_bootstrap_os h410s solidfire_\&_hci_storage_node universal_forwarder curl hci_compute_node h300s clustered_data_ontap debian_linux h410s_firmware fedora h500s_firmware h700s_firmware fabric_operating_system h700s https://github.com/curl/curl

CWE ID-CWE-522

Insufficiently Protected Credentials

CVE-2021-22923

Matching Score-6

Assigner-HackerOne

View Details

Matching Score-6

Assigner-HackerOne

CVSS Score-5.3||MEDIUM

EPSS-0.07% / 20.75%

7 Day CHG~0.00%

Published-05 Aug, 2021 | 00:00

Updated-19 Nov, 2024 | 14:25

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

Vendor-n/a NetApp, Inc.Oracle Corporation Siemens AG Splunk LLC (Cisco Systems, Inc.)CURL Fedora Project

CWE ID-CWE-319

Cleartext Transmission of Sensitive Information

CWE ID-CWE-522

Insufficiently Protected Credentials

CVE-2026-3783

Matching Score-6

Assigner-curl

View Details

Matching Score-6

Assigner-curl

CVSS Score-5.3||MEDIUM

EPSS-0.02% / 6.70%

7 Day CHG~0.00%

Published-11 Mar, 2026 | 10:09

Updated-12 Mar, 2026 | 14:10

token leak with redirect and netrc

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.

Vendor-CURL

Product-curl curl

CWE ID-CWE-522

Insufficiently Protected Credentials

CVE-2022-27774

Matching Score-6

Assigner-HackerOne

View Details

Matching Score-6

Assigner-HackerOne

CVSS Score-5.7||MEDIUM

EPSS-0.31% / 53.91%

7 Day CHG~0.00%

Published-01 Jun, 2022 | 00:00

Updated-16 Apr, 2026 | 14:16

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Vendor-n/a Debian GNU/Linux Splunk LLC (Cisco Systems, Inc.)Brocade Communications Systems, Inc. (Broadcom Inc.)NetApp, Inc.CURL

Product-hci_bootstrap_os solidfire_\&_hci_management_node h700s_firmware curl clustered_data_ontap solidfire_\&_hci_storage_node h500s_firmware h410s_firmware h500s h700s debian_linux fabric_operating_system h300s universal_forwarder h300s_firmware hci_compute_node h410s https://github.com/curl/curl

CWE ID-CWE-522

Insufficiently Protected Credentials

CVE-2026-6253

Credits

proxy credentials leak over redirect-to proxy

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs