libcurl Proxy Auth State Leakage Across Transfers via Env Config (CVE-2026-8927)

Vulnerability Overview Vulnerability ID: CVE-2026-8927 Description: When libcurl handles consecutive transfers driven by environment variable proxy configurations, it fails to clear the proxy authentication state between requests. Specifically, if the initial transfer uses proxy authentication (such as Digest auth) for proxy transmission, subsequent transfers erroneously leak the “Proxy-Authorization” header, leading to authentication bypass. Severity: Medium Last Modified: 2026-06-24T08:00:00.002Z Publish Date: 2026-06-24T08:00:00.002Z Affected Versions Affected Versions: - 8.20.0 to 8.21.0 (inclusive) - 8.19.0 to 8.21.0 (inclusive) - 8.18.0 to 8.21.0 (inclusive) - 8.17.0 to 8.21.0 (inclusive) - 8.16.0 to 8.21.0 (inclusive) - 8.15.0 to 8.21.0 (inclusive) - 8.14.1 to 8.21.0 (inclusive) - 8.13.0 to 8.21.0 (inclusive) - 8.12.1 to 8.21.0 (inclusive) - 8.12.0 to 8.21.0 (inclusive) - 8.11.1 to 8.21.0 (inclusive) - 8.11.0 to 8.21.0 (inclusive) - 8.10.1 to 8.21.0 (inclusive) - 8.10.0 to 8.21.0 (inclusive) - 8.9.1 to 8.21.0 (inclusive) - 8.9.0 to 8.21.0 (inclusive) - 8.8.0 to 8.21.0 (inclusive) - 8.7.1 to 8.21.0 (inclusive) - 8.7.0 to 8.21.0 (inclusive) - 8.6.0 to 8.21.0 (inclusive) - 8.5.0 to 8.21.0 (inclusive) - 8.4.0 to 8.21.0 (inclusive) - 8.3.0 to 8.21.0 (inclusive) - 8.2.0 to 8.21.0 (inclusive) - 8.1.2 to 8.21.0 (inclusive) - 8.1.1 to 8.21.0 (inclusive) - 8.0.0 to 8.21.0 (inclusive) - 7.88.1 to 8.21.0 (inclusive) - 7.88.0 to 8.21.0 (inclusive) - 7.87.0 to 8.21.0 (inclusive) - 7.86.0 to 8.21.0 (inclusive) - 7.84.0 to 8.21.0 (inclusive) - 7.83.1 to 8.21.0 (inclusive) - 7.83.0 to 8.21.0 (inclusive) - 7.82.0 to 8.21.0 (inclusive) - 7.81.0 to 8.21.0 (inclusive) - 7.79.1 to 8.21.0 (inclusive) - 7.78.0 to 8.21.0 (inclusive) - 7.77.0 to 8.21.0 (inclusive) - 7.76.1 to 8.21.0 (inclusive) - 7.76.0 to 8.21.0 (inclusive) - 7.75.0 to 8.21.0 (inclusive) - 7.74.0 to 8.21.0 (inclusive) - 7.73.0 to 8.21.0 (inclusive) - 7.72.0 to 8.21.0 (inclusive) - 7.71.1 to 8.21.0 (inclusive) - 7.71.0 to 8.21.0 (inclusive) - 7.69.1 to 8.21.0 (inclusive) - 7.68.0 to 8.21.0 (inclusive) - 7.67.0 to 8.21.0 (inclusive) - 7.66.0 to 8.21.0 (inclusive) - 7.65.1 to 8.21.0 (inclusive) - 7.65.0 to 8.21.0 (inclusive) - 7.64.1 to 8.21.0 (inclusive) - 7.64.0 to 8.21.0 (inclusive) - 7.63.0 to 8.21.0 (inclusive) - 7.62.0 to 8.21.0 (inclusive) - 7.61.1 to 8.21.0 (inclusive) - 7.60.0 to 8.21.0 (inclusive) - 7.59.0 to 8.21.0 (inclusive) - 7.58.0 to 8.21.0 (inclusive) - 7.57.0 to 8.21.0 (inclusive) - 7.56.1 to 8.21.0 (inclusive) - 7.56.0 to 8.21.0 (inclusive) - 7.55.1 to 8.21.0 (inclusive) - 7.55.0 to 8.21.0 (inclusive) - 7.54.1 to 8.21.0 (inclusive) - 7.54.0 to 8.21.0 (inclusive) - 7.53.1 to 8.21.0 (inclusive) - 7.53.0 to 8.21.0 (inclusive) - 7.52.1 to 8.21.0 (inclusive) - 7.52.0 to 8.21.0 (inclusive) - 7.51.0 to 8.21.0 (inclusive) - 7.50.2 to 8.21.0 (inclusive) - 7.50.1 to 8.21.0 (inclusive) - 7.49.1 to 8.21.0 (inclusive) - 7.49.0 to 8.21.0 (inclusive) - 7.48.0 to 8.21.0 (inclusive) - 7.47.1 to 8.21.0 (inclusive) - 7.47.0 to 8.21.0 (inclusive) - 7.46.0 to 8.21.0 (inclusive) - 7.45.0 to 8.21.0 (inclusive) - 7.44.0 to 8.21.0 (inclusive) - 7.43.0 to 8.21.0 (inclusive) - 7.42.0 to 8.21.0 (inclusive) - 7.41.0 to 8.21.0 (inclusive) - 7.40.0 to 8.21.0 (inclusive) - 7.39.0 to 8.21.0 (inclusive) - 7.38.0 to 8.21.0 (inclusive) - 7.37.0 to 8.21.0 (inclusive) - 7.36.0 to 8.21.0 (inclusive) - 7.35.0 to 8.21.0 (inclusive) - 7.34.0 to 8.21.0 (inclusive) - 7.33.0 to 8.21.0 (inclusive) - 7.32.1 to 8.21.0 (inclusive) - 7.32.0 to 8.21.0 (inclusive) - 7.31.0 to 8.21.0 (inclusive) - 7.30.0 to 8.21.0 (inclusive) - 7.29.0 to 8.21.0 (inclusive) - 7.28.1 to 8.21.0 (inclusive) - 7.28.0 to 8.21.0 (inclusive) - 7.27.0 to 8.21.0 (inclusive) - 7.26.0 to 8.21.0 (inclusive) - 7.25.0 to 8.21.0 (inclusive) - 7.24.0 to 8.21.0 (inclusive) - 7.23.1 to 8.21.0 (inclusive) - 7.23.0 to 8.21.0 (inclusive) - 7.22.0 to 8.21.0 (inclusive) - 7.21.1 to 8.21.0 (inclusive) - 7.21.0 to 8.21.0 (inclusive) - 7.20.1 to 8.21.0 (inclusive) - 7.20.0 to 8.21.0 (inclusive) - 7.19.7 to 8.21.0 (inclusive) - 7.19.6 to 8.21.0 (inclusive) - 7.19.5 to 8.21.0 (inclusive) - 7.19.4 to 8.21.0 (inclusive) - 7.19.3 to 8.21.0 (inclusive) - 7.19.1 to 8.21.0 (inclusive) - 7.18.2 to 8.21.0 (inclusive) - 7.18.1 to 8.21.0 (inclusive) - 7.18.0 to 8.21.0 (inclusive) - 7.17.1 to 8.21.0 (inclusive) - 7.17.0 to 8.21.0 (inclusive) - 7.16.4 to 8.21.0 (inclusive) - 7.16.3 to 8.21.0 (inclusive) - 7.16.1 to 8.21.0 (inclusive) - 7.16.0 to 8.21.0 (inclusive) - 7.15.5 to 8.21.0 (inclusive) - 7.15.4 to 8.21.0 (inclusive) - 7.15.3 to 8.21.0 (inclusive) - 7.15.2 to 8.21.0 (inclusive) - 7.15.1 to 8.21.0 (inclusive) - 7.15.0 to 8.21.0 (inclusive) - 7.14.1 to 8.21.0 (inclusive) - 7.14.0 to 8.21.0 (inclusive) - 7.13.2 to 8.21.0 (inclusive) - 7.13.1 to 8.21.0 (inclusive) - 7.13.0 to 8.21.0 (inclusive) - 7.12.3 to 8.21.0 (inclusive) - 7.12.2 to 8.21.0 (inclusive) - 7.12.1 to 8.21.0 (inclusive) - 7.12.0 to 8.21.0 (inclusive) Remediation Fixed Versions: - 8

Goal Reached Thanks to every supporter — we hit 100%!

libcurl Proxy Auth State Leakage Across Transfers via Env Config (CVE-2026-8927)