CVE-2026-7168: cross-proxy Digest auth state leak
cross-proxy Digest auth state leak
Other sources
Successfully using libcurl to do a transfer over a specific HTTP proxy (proxyA) with Digest authentication and then changing the proxy host to a second one (proxyB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Proxy-Authorization: header field meant for proxyA, to proxyB.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 8.14.1-2+deb13u4Fixed in 8.20.0-5Fixed in 8.21.0-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7168?
CVE-2026-7168 is classified as a medium severity vulnerability due to potential credential leakage during proxy transitions.
How do I fix CVE-2026-7168?
To fix CVE-2026-7168, it is recommended to update libcurl to the latest version that is above 8.20.0.
Can CVE-2026-7168 be exploited remotely?
Yes, CVE-2026-7168 can be exploited remotely when the affected software is configured to use specific HTTP proxies.
What affected software versions are vulnerable to CVE-2026-7168?
Affected versions for CVE-2026-7168 are between 7.12.0 and 8.20.0 of curl libcurl.
What impact does CVE-2026-7168 have on user data?
CVE-2026-7168 can lead to unauthorized disclosure of proxy authentication credentials, potentially compromising user data.