CVE-2026-7168

Published: Mag 13, 2026 Last Modified: Mag 13, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

Successfully using libcurl to do a transfer over a specific HTTP proxy
(`proxyA`) with **Digest** authentication and then changing the proxy host to
a second one (`proxyB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Proxy-Authorization:` header field meant for
`proxyA`, to `proxyB`.

https://curl.se/docs/CVE-2026-7168.html
https://curl.se/docs/CVE-2026-7168.html
https://curl.se/docs/CVE-2026-7168.json
https://curl.se/docs/CVE-2026-7168.json
https://hackerone.com/reports/3697719
https://hackerone.com/reports/3697719
http://www.openwall.com/lists/oss-security/2026/04/29/14
http://www.openwall.com/lists/oss-security/2026/04/29/14