CVE-2026-3784
6.5 MEDIUMcurl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials ...
Published: 2026-03-11 · Last updated: 2026-06-02
Severity and scoring
- CVSS
- 6.5 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- CWE
- CWE-305
Affected products
| Vendor | Product |
|---|---|
| haxx | curl |
Description
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-3784
- [Patch]https://curl.se/docs/CVE-2026-3784.html
- [Vendor advisory]https://curl.se/docs/CVE-2026-3784.json
- [Exploit reference]https://hackerone.com/reports/3584903
- [Other]http://www.openwall.com/lists/oss-security/2026/03/11/3
- [Other]https://cert-portal.siemens.com/productcert/html/ssa-253495.html
Related CVEs
Same vendor
- CVE-2025-10966 — curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mec... (4.3 MEDIUM)
- CVE-2025-9086 — 1 (7.5 HIGH)
- CVE-2022-27782 — libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reu... (7.5 HIGH)
- CVE-2022-27781 — libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.... (7.5 HIGH)
- CVE-2022-27775 — An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the conn... (7.5 HIGH)
Same CWE
- CVE-2025-7064 — Authentication bypass by primary weakness vulnerability in ABB Freelance (6.6 MEDIUM)
- CVE-2026-25555 — OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows un... (9.8 CRITICAL)
- CVE-2026-9798 — A flaw was found in Keycloak, an open-source identity and access management solution (4.3 MEDIUM)
- CVE-2026-41054 — In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`) (7.8 HIGH)
- CVE-2026-6334 — Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code red... (3.1 LOW)