CVE-2026-6253: proxy credentials leak over redirect-to proxy
curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6253?
CVE-2026-6253 is classified as a medium severity vulnerability due to the potential credential leakage.
How do I fix CVE-2026-6253?
To fix CVE-2026-6253, ensure that you are using the latest version of curl where this vulnerability has been addressed.
What versions of curl are affected by CVE-2026-6253?
CVE-2026-6253 affects curl versions between 7.14.1 and 8.20.0 inclusive.
What is the main risk associated with CVE-2026-6253?
The main risk associated with CVE-2026-6253 is the unintended leak of proxy credentials during redirection between proxies.
How can I mitigate the risks of CVE-2026-6253?
To mitigate the risks of CVE-2026-6253, avoid configuring multiple proxies with differing authentication requirements for the same session.