curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 11, 2026 · NIST NVD

   Detected

   curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

2. Sep 15, 2026 · NIST NVD

   Updated

   curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

Affected

• cpe haxx/curlversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-3784

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-3784

  curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

  nvd.nist.gov

References

• Mailing List · openwall.com
• Reference · cert-portal.siemens.com
• Patch · curl.se
• Vendor Advisory · curl.se
• Exploit · hackerone.com