Vulnerability · Published Jul 3, 2026 · Assigned by curl
CVE-2026-8927env-set cross-proxy Digest auth state leak
Critical 9.1
In plain English
A critical-severity security flaw in curl from curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | curl | 8.12.1-4.el10_2.4 | ALSA-2026:55432 |
| AlmaLinux:8 | curl | 7.61.1-34.el8_10.18 | ALSA-2026:92368 |
| AlmaLinux:9 | curl | 7.76.1-40.el9_8.7 | ALSA-2026:69126 |
| AlmaLinux:9 | curl-minimal | 7.76.1-40.el9_8.7 | ALSA-2026:69126 |
| AlmaLinux:10 | libcurl | 8.12.1-4.el10_2.4 | ALSA-2026:55432 |
| AlmaLinux:8 | libcurl | 7.61.1-34.el8_10.18 | ALSA-2026:92368 |
| AlmaLinux:9 | libcurl | 7.76.1-40.el9_8.7 | ALSA-2026:69126 |
| AlmaLinux:10 | libcurl-devel | 8.12.1-4.el10_2.4 | ALSA-2026:55432 |
| AlmaLinux:8 | libcurl-devel | 7.61.1-34.el8_10.18 | ALSA-2026:92368 |
| AlmaLinux:9 | libcurl-devel | 7.76.1-40.el9_8.7 | ALSA-2026:69126 |
| AlmaLinux:10 | libcurl-minimal | 8.12.1-4.el10_2.4 | ALSA-2026:55432 |
| AlmaLinux:8 | libcurl-minimal | 7.61.1-34.el8_10.18 | ALSA-2026:92368 |
| AlmaLinux:9 | libcurl-minimal | 7.76.1-40.el9_8.7 | ALSA-2026:69126 |
| Alpine:v3.21 | curl | 8.14.1-r3 | ALPINE-CVE-2026-8927 |
| Alpine:v3.22 | curl | 8.14.1-r4 | ALPINE-CVE-2026-8927 |
| Alpine:v3.23 | curl | 8.22.0-r0 | ALPINE-CVE-2026-8927 |
| Alpine:v3.24 | curl | 8.21.0-r0 | ALPINE-CVE-2026-8927 |
| Debian:12 | curl | no fix listed | DEBIAN-CVE-2026-8927 |
| Debian:13 | curl | 8.14.1-2+deb13u7 | DEBIAN-CVE-2026-8927 |
| Debian:14 | curl | 8.21.0~rc2-1 | DEBIAN-CVE-2026-8927 |
| Rocky Linux:10 | curl | 0:8.12.1-4.el10_2.4 | RLSA-2026:55432 |
| Rocky Linux:8 | curl | 0:7.61.1-34.el8_10.18 | RLSA-2026:92368 |
| Rocky Linux:9 | curl | 0:7.76.1-40.el9_8.7 | RLSA-2026:69126 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.25 | UBUNTU-CVE-2026-8927 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.29 | USN-8820-1 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.15 | USN-8820-1 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.10 | UBUNTU-CVE-2026-8927 |
| Ubuntu:25.10 | curl | 8.14.1-2ubuntu1.4 | UBUNTU-CVE-2026-8927 |
| Ubuntu:26.04:LTS | curl | 8.18.0-1ubuntu2.2 | UBUNTU-CVE-2026-8927 |
| Ubuntu:26.04:LTS | curl | 8.18.0-1ubuntu2.7 | USN-8820-1 |
Affected products (as reported)
Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N