curl might erroneously pass on credentials for a first proxy to a second proxy.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 13, 2026 · NIST NVD

   Detected

   curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say ), curl is asked to follow a redirect to a URL using another scheme

2. Sep 15, 2026 · NIST NVD

   Updated

   curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say ), curl is asked to follow a redirect to a URL using another scheme

Affected

• cpe haxx/curlversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-6253

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-6253

  curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no

  nvd.nist.gov

References

• Mailing List · openwall.com
• Patch · curl.se
• Vendor Advisory · curl.se
• Exploit · hackerone.com