CVE-2026-8927: env-set cross-proxy Digest auth state leak
env-set cross-proxy Digest auth state leak
Other sources
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.21.0-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8927?
CVE-2026-8927 has a risk rating of 21, indicating a significant vulnerability.
How do I fix CVE-2026-8927?
To fix CVE-2026-8927, upgrade to the latest version of libcurl where the proxy authentication state issue is addressed.
What systems are affected by CVE-2026-8927?
CVE-2026-8927 affects environments using the libcurl library with proxy configurations, specifically in sequential transfers.
What type of vulnerability is CVE-2026-8927?
CVE-2026-8927 is classified as an environment-variable cross-proxy Digest authentication state leak.
Can I mitigate the risks of CVE-2026-8927 without updating?
While updating is the best option, you may mitigate risks by avoiding the reuse of libcurl handles across different proxy configurations.