CVE-2026-7168: cross-proxy Digest auth state leak
Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7168?
CVE-2026-7168 is classified as a medium severity vulnerability due to potential credential leakage during proxy transitions.
How do I fix CVE-2026-7168?
To fix CVE-2026-7168, it is recommended to update libcurl to the latest version that is above 8.20.0.
Can CVE-2026-7168 be exploited remotely?
Yes, CVE-2026-7168 can be exploited remotely when the affected software is configured to use specific HTTP proxies.
What affected software versions are vulnerable to CVE-2026-7168?
Affected versions for CVE-2026-7168 are between 7.12.0 and 8.20.0 of curl libcurl.
What impact does CVE-2026-7168 have on user data?
CVE-2026-7168 can lead to unauthorized disclosure of proxy authentication credentials, potentially compromising user data.