CVE-2026-6253: 
cURL vulnerability analysis and mitigation

CVE-2026-6253 is a credential leakage vulnerability in curl and libcurl, titled "proxy credentials leak over redirect-to proxy," in which curl may erroneously forward the credentials of a first proxy to a second, unintended proxy during cross-scheme redirects. It affects curl versions 7.14.1 through 8.19.0 (inclusive), covering both the curl command-line tool and libcurl. The vulnerability was reported on April 13, 2026, and publicly disclosed on April 29, 2026, coordinated with the release of curl 8.20.0. It carries a CVSS v3.1 base score of 5.9 (Medium) (curl Advisory, Openwall OSS-Sec).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials). The flaw is triggered when curl is configured to use different proxies for different URL schemes (e.g., one proxy for http:// and another for https://), the first proxy requires credentials, and the second proxy does not. When curl follows a redirect from the first scheme to the second, it erroneously carries over the first proxy's credentials — transmitted as base64-encoded values — to the second proxy, which has no legitimate use for them. The vulnerability was introduced in commit 3b60bb725913ce and fixed in commit 188c2f166a20fa97c2325 (curl Advisory, curl JSON). The original report was filed via HackerOne (HackerOne Report).

The primary impact is confidentiality loss of proxy authentication credentials: the base64-encoded credentials for the first proxy are unintentionally sent to a second, potentially untrusted proxy, which could log or capture them. The receiving proxy receives no contextual hint about the credentials' origin or validity, but a malicious or compromised second proxy could decode and reuse them. This could enable unauthorized access to systems or services protected by those proxy credentials, and may facilitate lateral movement in environments where proxy credentials are shared or reused across services (curl Advisory, Openwall OSS-Sec).

No public exploit code or weaponized exploit kit has been identified for this vulnerability. The HackerOne report (report #3669637) is referenced but contains no publicly accessible exploit details. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the near term (Feedly, HackerOne Report).

1. Setup prerequisite conditions: Identify a target environment where curl or libcurl is configured with scheme-specific proxies (e.g., --proxy http://proxy1:port for HTTP and --proxy https://proxy2:port for HTTPS), where the first proxy requires credentials and the second does not.
2. Control or monitor the second proxy: Position a malicious or monitored proxy as the second proxy (for the redirected scheme), capable of logging incoming HTTP headers.
3. Trigger a cross-scheme redirect: Cause curl to make a request via the first proxy (e.g., to an http:// URL) that results in a redirect to a URL using a different scheme (e.g., https://), which curl will follow using the second proxy.
4. Capture leaked credentials: Observe the Proxy-Authorization header arriving at the second proxy, which will contain the base64-encoded credentials intended only for the first proxy.
5. Decode and reuse credentials: Base64-decode the captured credentials to obtain the plaintext username and password, then attempt to use them against the first proxy or other services where they may be valid (curl Advisory, Openwall OSS-Sec).

• Network: Unexpected Proxy-Authorization headers appearing in traffic destined for a proxy that is not configured to require authentication; base64-encoded credential strings in proxy request headers on the second/unauthenticated proxy.
• Logs: Second proxy access logs showing Proxy-Authorization headers in requests that should not carry credentials; log entries indicating cross-scheme redirects (HTTP to HTTPS or vice versa) followed by authenticated proxy requests to the unauthenticated proxy.
• Application: curl or libcurl debug output (enabled with --verbose or CURLOPT_VERBOSE) showing Proxy-Authorization headers being sent to a proxy that does not require them during redirect-following operations.

The primary remediation is to upgrade curl and libcurl to version 8.20.0 or later, which contains the fix in commit 188c2f166a20fa97c2325. For environments unable to upgrade immediately, two workarounds are available: apply the upstream patch and rebuild libcurl, or avoid configuring proxies with embedded credentials when using scheme-specific proxy settings. Administrators should audit curl/libcurl deployments that use multi-proxy configurations with credentials and prioritize upgrading, as the fix was released April 29, 2026. Downstream distributions including Red Hat, Ubuntu, openSUSE, and others have issued updated packages (curl Advisory, Red Hat Errata, Ubuntu USN).

The vulnerability was disclosed by curl maintainer Daniel Stenberg via the oss-security mailing list and his personal blog post announcing curl 8.20.0, which bundled the fix (Daniel Stenberg Blog, Openwall OSS-Sec). The issue was credited to Dwij Mehta of O2 Lab at Texas A&M University. Downstream vendors including Red Hat, Ubuntu, openSUSE, SUSE, and Unraid issued security advisories and updated packages. Microsoft also acknowledged the CVE in its update guide. Community reaction was measured, consistent with the Medium severity rating and the relatively narrow exploitation conditions required.