p PatchFirst

ALPINE-CVE-2026-8927

ALPINE-CVE-2026-8927

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

CVSS 9.1 · Critical · Fix available

Published
Updated

Stack: system

Affected products and versions

  • curl Alpine:v3.21

    Affected ranges
    • ECOSYSTEM: ≥ 7.12.0, < 8.14.1-r3

    Update to 8.14.1-r3

  • curl Alpine:v3.22

    Affected ranges
    • ECOSYSTEM: ≥ 7.12.0, < 8.14.1-r4

    Update to 8.14.1-r4

  • curl Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: ≥ 7.12.0, < 8.22.0-r0

    Update to 8.22.0-r0

  • curl Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: ≥ 7.12.0, < 8.21.0-r0

    Update to 8.21.0-r0

Original sources

Check your server →