ZeroDay Findings
Sign inSign up

Findings

CVE-2026-7168

Successfully using libcurl to do a transfer over a specific HTTP proxy ( ) with **Digest** authentication and then changing the proxy host to a second one ( ) for a se…

Published May 13, 2026 · updated Sep 15, 2026 · haxx curl

Successfully using libcurl to do a transfer over a specific HTTP proxy ( ) with **Digest** authentication and then changing the proxy host to a second one ( ) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the header field meant for , to .

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 13, 2026 · NIST NVD

    Detected

    Successfully using libcurl to do a transfer over a specific HTTP proxy ( ) with **Digest** authentication and then changing the proxy host to a second one ( ) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the header field meant for , to .

  2. Sep 15, 2026 · NIST NVD

    Updated

    Successfully using libcurl to do a transfer over a specific HTTP proxy ( ) with **Digest** authentication and then changing the proxy host to a second one ( ) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the header field meant for , to .

Affected

  • cpe haxx/curlversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-7168

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-7168

    Successfully using libcurl to do a transfer over a specific HTTP proxy ( ) with **Digest** authentication and then changing the proxy host to a second one ( ) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the he

    nvd.nist.gov

References