CVE-2026-3784: wrong proxy connection reuse with credentials
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3784?
CVE-2026-3784 is classified as a medium-severity vulnerability due to its potential to compromise user credentials through improper proxy connection handling.
How do I fix CVE-2026-3784?
To fix CVE-2026-3784, you should upgrade to a patched version of libcurl that properly manages proxy connections and credentials.
What software is affected by CVE-2026-3784?
CVE-2026-3784 affects the redhat/libcurl software package, particularly those versions that improperly reuse HTTP proxy connections.
What are the risks associated with CVE-2026-3784?
The risks of CVE-2026-3784 include the potential for sensitive data exposure and unauthorized access due to credential leakage from proxy connections.
Is there a workaround for CVE-2026-3784?
As a temporary workaround for CVE-2026-3784, avoid using the affected versions of libcurl until an upgrade can be applied.