CVE-2026-9079

CriticalCVSS 9.8/10Last modified Sep 15, 2026

Description

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
curl	curl	>= 8.8.0, < 8.14.2; >= 8.15.0, < 8.16.1; >= 8.17.0, < 8.20.1
curl	curl	>= d5e83eb745762f48d8fafadc5df5dd3ae8d8941e, < 88c7e16cceec816a2df45c899d49b1e85513f193
curl	curl	8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0

References

https://curl.se/docs/CVE-2026-9079.htmlPatch, Vendor Advisory
https://curl.se/docs/CVE-2026-9079.jsonVendor Advisory
https://hackerone.com/reports/3750295Exploit, Issue Tracking, Third Party Advisory
https://hackerone.com/reports/3750295Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jul 3, 2026
Last modified: Sep 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-907906.3A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the fil CVE-2026-907916.3A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_CVE-2026-907924.3A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.CVE-2026-907935.4A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of CVE-2026-907946.3A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c CVE-2026-907954.3A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.ph CVE-2026-907966.3A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/ind CVE-2026-907977.7An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a den CVE-2026-907980.6A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or t CVE-2026-907991.3Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of CVE-2026-90807.3Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl CVE-2026-908008.1Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a