Successfully using libcurl to do a transfer over a specific HTTP proxy
(`proxyA`) with **Digest** authentication and then changing the proxy host to
a second one (`proxyB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Proxy-Authorization:` header field meant for
`proxyA`, to `proxyB`.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Curl |
|
| Haxx |
|
No data.
References
History
Thu, 14 May 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Haxx
Haxx curl |
|
| Weaknesses | CWE-294 | |
| CPEs | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Haxx
Haxx curl |
Wed, 13 May 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 13 May 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 13 May 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Curl
Curl curl |
|
| Vendors & Products |
Curl
Curl curl |
Wed, 13 May 2026 09:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`. | |
| Title | cross-proxy Digest auth state leak | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: curl
Published: 2026-05-13T08:29:08.900Z
Updated: 2026-05-13T14:18:13.718Z
Reserved: 2026-04-27T07:37:37.172Z
Link: CVE-2026-7168
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2026-05-13T13:01:57.200
Modified: 2026-05-14T14:12:48.457
Link: CVE-2026-7168
Redhat
No data.