CVE-2026-6253
CVE-2026-6253 · proxy credentials leak over redirect-to proxy
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy
CVSS 5.9 · Medium · EPSS 0.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
curl
- Versions
- ≥ 7.14.1, < 8.14.2: Affected (semver)
- ≥ 8.15.0, < 8.16.1: Affected (semver)
- ≥ 8.17.0, < 8.20.0: Affected (semver)
Update to 8.14.2; Update to 8.16.1; Update to 8.20.0
curl
- Versions
- ≥ 3b60bb725913ce7339aefef0a14b12df4c24db60, < 188c2f166a20fa97c2325b2da7d0e5cecc13725f: Affected (git)
No fix published
curl
- Versions
- 8.19.0: Affected
- 8.18.0: Affected
- 8.17.0: Affected
- 8.16.0: Affected
- 8.15.0: Affected
- 8.14.1: Affected
- 8.14.0: Affected
- 8.13.0: Affected
- 8.12.1: Affected
- 8.12.0: Affected
- 8.11.1: Affected
- 8.11.0: Affected
- 8.10.1: Affected
- 8.10.0: Affected
- 8.9.1: Affected
- 8.9.0: Affected
- 8.8.0: Affected
- 8.7.1: Affected
- 8.7.0: Affected
- 8.6.0: Affected
- 8.5.0: Affected
- 8.4.0: Affected
- 8.3.0: Affected
- 8.2.1: Affected
- 8.2.0: Affected
- 8.1.2: Affected
- 8.1.1: Affected
- 8.1.0: Affected
- 8.0.1: Affected
- 8.0.0: Affected
- 7.88.1: Affected
- 7.88.0: Affected
- 7.87.0: Affected
- 7.86.0: Affected
- 7.85.0: Affected
- 7.84.0: Affected
- 7.83.1: Affected
- 7.83.0: Affected
- 7.82.0: Affected
- 7.81.0: Affected
- 7.80.0: Affected
- 7.79.1: Affected
- 7.79.0: Affected
- 7.78.0: Affected
- 7.77.0: Affected
- 7.76.1: Affected
- 7.76.0: Affected
- 7.75.0: Affected
- 7.74.0: Affected
- 7.73.0: Affected
- 7.72.0: Affected
- 7.71.1: Affected
- 7.71.0: Affected
- 7.70.0: Affected
- 7.69.1: Affected
- 7.69.0: Affected
- 7.68.0: Affected
- 7.67.0: Affected
- 7.66.0: Affected
- 7.65.3: Affected
- 7.65.2: Affected
- 7.65.1: Affected
- 7.65.0: Affected
- 7.64.1: Affected
- 7.64.0: Affected
- 7.63.0: Affected
- 7.62.0: Affected
- 7.61.1: Affected
- 7.61.0: Affected
- 7.60.0: Affected
- 7.59.0: Affected
- 7.58.0: Affected
- 7.57.0: Affected
- 7.56.1: Affected
- 7.56.0: Affected
- 7.55.1: Affected
- 7.55.0: Affected
- 7.54.1: Affected
- 7.54.0: Affected
- 7.53.1: Affected
- 7.53.0: Affected
- 7.52.1: Affected
- 7.52.0: Affected
- 7.51.0: Affected
- 7.50.3: Affected
- 7.50.2: Affected
- 7.50.1: Affected
- 7.50.0: Affected
- 7.49.1: Affected
- 7.49.0: Affected
- 7.48.0: Affected
- 7.47.1: Affected
- 7.47.0: Affected
- 7.46.0: Affected
- 7.45.0: Affected
- 7.44.0: Affected
- 7.43.0: Affected
- 7.42.1: Affected
- 7.42.0: Affected
- 7.41.0: Affected
- 7.40.0: Affected
- 7.39.0: Affected
No fix published
curl Debian:12
- Versions
- 7.88.1-10
- 7.88.1-10+deb12u1
- 7.88.1-10+deb12u11
- 7.88.1-10+deb12u12
- 7.88.1-10+deb12u13
- 7.88.1-10+deb12u14
- 7.88.1-10+deb12u15
- 7.88.1-10+deb12u1~bpo11+1
- 7.88.1-10+deb12u2
- 7.88.1-10+deb12u3
- 7.88.1-10+deb12u3~bpo11+1
- 7.88.1-10+deb12u4
- 7.88.1-10+deb12u5
- 7.88.1-10+deb12u5~bpo11+1
- 7.88.1-10+deb12u6
- 7.88.1-10+deb12u6~bpo11+1
- 7.88.1-10+deb12u7
- 7.88.1-10+deb12u8
- 7.88.1-10+deb12u9
- 7.88.1-11
- 8.0.1-1~exp1
- 8.10.0-1
- 8.10.0-2
- 8.10.1-1
- 8.10.1-1~bpo12+1
- 8.10.1-2
- 8.11.0-1
- 8.11.1-1
- 8.11.1-1~bpo12+1
- 8.12.0+git20250209.89ed161+ds-1
- 8.12.0+git20250209.89ed161+ds-1~bpo12+1
- 8.12.1-1
- 8.12.1-2
- 8.12.1-2~bpo12+1
- 8.12.1-3
- 8.12.1-3~bpo12+1
- 8.13.0-1
- 8.13.0-1+exp1
- 8.13.0-2
- 8.13.0-2+exp1
- 8.13.0-3
- 8.13.0-4
- 8.13.0-4+exp1
- 8.13.0-5
- 8.13.0-5+exp1
- 8.13.0-5~bpo12+1
- 8.13.0~rc-1~exp1
- 8.13.0~rc-1~exp2
- 8.13.0~rc2-1
- 8.13.0~rc2-2
- 8.13.0~rc3-1
- 8.13.0~rc3-1+exp1
- 8.14.0-1
- 8.14.0-1+exp1
- 8.14.0~rc1-1+exp1
- 8.14.0~rc2-1+exp1
- 8.14.0~rc3-1+exp1
- 8.14.1-1
- 8.14.1-1~bpo12+1
- 8.14.1-2
- 8.14.1-2+exp1
- 8.14.1-2~bpo12+1
- 8.15.0-1
- 8.15.0-1~bpo13+1
- 8.15.0-1~exp1
- 8.15.0~rc1-1exp1
- 8.15.0~rc2-1~exp1
- 8.15.0~rc3-1~exp1
- 8.16.0-1
- 8.16.0-1+exp1
- 8.16.0-1~bpo13+1
- 8.16.0-2
- 8.16.0-3
- 8.16.0-4
- 8.16.0-4~bpo13+1
- 8.16.0~rc1-1~exp1
- 8.16.0~rc2-1
- 8.16.0~rc2-2
- 8.16.0~rc3-1
- 8.17.0-1
- 8.17.0-2
- 8.17.0-3
- 8.17.0~rc1-1~exp1
- 8.17.0~rc2-1
- 8.17.0~rc3-1
- 8.18.0-1
- 8.18.0-1~bpo13+1
- 8.18.0-2
- 8.18.0~rc1-1+exp1
- 8.18.0~rc2-1
- 8.18.0~rc3-1
- 8.19.0-1
- 8.19.0-1+exp1
- 8.19.0-1~bpo13+1
- 8.19.0-2
- 8.19.0-3
- 8.19.0-3+exp1
- 8.19.0-3+exp2
- 8.19.0~rc1-1~exp1
- 8.19.0~rc2-1
- 8.19.0~rc2-2
- 8.19.0~rc3-1
- 8.2.1-1
- 8.2.1-2
- 8.2.1-2~bpo12+1
- 8.20.0-1
- 8.20.0-1+exp
- 8.20.0-2
- 8.20.0-2+exp1
- 8.20.0-2~bpo13+1
- 8.20.0-3
- 8.20.0-4
- 8.20.0-5
- 8.20.0-5~bpo13+1
- 8.20.0~rc1-1+exp1
- 8.20.0~rc1-1+exp2
- 8.20.0~rc1-1+exp3
- 8.20.0~rc2-1
- 8.20.0~rc2-1+exp1
- 8.20.0~rc3-1
- 8.20.0~rc3-1+exp1
- 8.21.0-1
- 8.21.0-1+exp1
- 8.21.0-2
- 8.21.0-2+exp1
- 8.21.0-2~bpo13+1
- 8.21.0~rc1-1+exp1
- 8.21.0~rc2-1
- 8.21.0~rc2-1+exp1
- 8.21.0~rc3-1
- 8.21.0~rc3-1+exp1
- 8.22.0-1
- 8.22.0-1+exp1
- 8.22.0~rc2-1
- 8.22.0~rc2-2
- 8.22.0~rc3-1
- 8.22.0~rc3-1+exp1
- 8.23.0~rc1-1
- 8.23.0~rc1-2
- 8.23.0~rc2-1
- 8.23.0~rc2-1+exp1
- 8.3.0-1
- 8.3.0-2
- 8.3.0-2~bpo12+1
- 8.3.0-2~exp1
- 8.3.0-3
- 8.4.0-1
- 8.4.0-2
- 8.4.0-2~bpo12+1
- 8.5.0-1
- 8.5.0-1+exp1
- 8.5.0-2
- 8.5.0-2+exp1
- 8.5.0-2~bpo12+1
- 8.6.0-1
- 8.6.0-1.1
- 8.6.0-2
- 8.6.0-3
- 8.6.0-3.1
- 8.6.0-3.1~exp1
- 8.6.0-3.1~exp2
- 8.6.0-3.2
- 8.6.0-4
- 8.7.1-1
- 8.7.1-1+exp1
- 8.7.1-2
- 8.7.1-3
- 8.7.1-4
- 8.7.1-5
- 8.7.1-5+exp1
- 8.7.1-5~bpo12+1
- 8.8.0-1
- 8.8.0-1+exp1
- 8.8.0-1+exp2
- 8.8.0-1~bpo12+1
- 8.8.0-2
- 8.8.0-3
- 8.8.0-4
- 8.9.0-1
- 8.9.0-2
- 8.9.0-3
- 8.9.1-1
- 8.9.1-2
- 8.9.1-2~bpo12+1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
curl Debian:13
- Versions
- 8.14.1-2
- 8.14.1-2+deb13u1
- 8.14.1-2+deb13u2
- 8.14.1-2+deb13u2~bpo13+1
- 8.14.1-2+deb13u3
- Affected ranges
- ECOSYSTEM: < 8.14.1-2+deb13u4
Update to 8.14.1-2+deb13u4
curl Debian:14
- Versions
- 8.14.1-2
- 8.14.1-2+exp1
- 8.15.0-1
- 8.15.0-1~bpo13+1
- 8.15.0-1~exp1
- 8.15.0~rc1-1exp1
- 8.15.0~rc2-1~exp1
- 8.15.0~rc3-1~exp1
- 8.16.0-1
- 8.16.0-1+exp1
- 8.16.0-1~bpo13+1
- 8.16.0-2
- 8.16.0-3
- 8.16.0-4
- 8.16.0-4~bpo13+1
- 8.16.0~rc1-1~exp1
- 8.16.0~rc2-1
- 8.16.0~rc2-2
- 8.16.0~rc3-1
- 8.17.0-1
- 8.17.0-2
- 8.17.0-3
- 8.17.0~rc1-1~exp1
- 8.17.0~rc2-1
- 8.17.0~rc3-1
- 8.18.0-1
- 8.18.0-1~bpo13+1
- 8.18.0-2
- 8.18.0~rc1-1+exp1
- 8.18.0~rc2-1
- 8.18.0~rc3-1
- 8.19.0-1
- 8.19.0-1+exp1
- 8.19.0-1~bpo13+1
- 8.19.0-2
- 8.19.0-3
- 8.19.0-3+exp1
- 8.19.0-3+exp2
- 8.19.0~rc1-1~exp1
- 8.19.0~rc2-1
- 8.19.0~rc2-2
- 8.19.0~rc3-1
- 8.20.0~rc1-1+exp1
- 8.20.0~rc1-1+exp2
- 8.20.0~rc1-1+exp3
- 8.20.0~rc2-1
- 8.20.0~rc2-1+exp1
- Affected ranges
- ECOSYSTEM: < 8.20.0~rc3-1
Update to 8.20.0~rc3-1
curl Ubuntu:Pro:14.04:LTS
- Versions
- 7.32.0-1ubuntu1
- 7.33.0-1ubuntu1
- 7.34.0-1ubuntu1
- 7.35.0-1ubuntu1
- 7.35.0-1ubuntu2
- 7.35.0-1ubuntu2.1
- 7.35.0-1ubuntu2.2
- 7.35.0-1ubuntu2.3
- 7.35.0-1ubuntu2.5
- 7.35.0-1ubuntu2.6
- 7.35.0-1ubuntu2.7
- 7.35.0-1ubuntu2.8
- 7.35.0-1ubuntu2.9
- 7.35.0-1ubuntu2.10
- 7.35.0-1ubuntu2.11
- 7.35.0-1ubuntu2.12
- 7.35.0-1ubuntu2.13
- 7.35.0-1ubuntu2.14
- 7.35.0-1ubuntu2.15
- 7.35.0-1ubuntu2.16
- 7.35.0-1ubuntu2.17
- 7.35.0-1ubuntu2.19
- 7.35.0-1ubuntu2.20
- 7.35.0-1ubuntu2.20+esm2
- 7.35.0-1ubuntu2.20+esm3
- 7.35.0-1ubuntu2.20+esm4
- 7.35.0-1ubuntu2.20+esm5
- 7.35.0-1ubuntu2.20+esm6
- 7.35.0-1ubuntu2.20+esm7
- 7.35.0-1ubuntu2.20+esm8
- 7.35.0-1ubuntu2.20+esm9
- 7.35.0-1ubuntu2.20+esm10
- 7.35.0-1ubuntu2.20+esm11
- 7.35.0-1ubuntu2.20+esm12
- 7.35.0-1ubuntu2.20+esm13
- 7.35.0-1ubuntu2.20+esm14
- 7.35.0-1ubuntu2.20+esm15
- 7.35.0-1ubuntu2.20+esm16
- 7.35.0-1ubuntu2.20+esm17
- 7.35.0-1ubuntu2.20+esm18
- 7.35.0-1ubuntu2.20+esm19
- 7.35.0-1ubuntu2.20+esm20
- 7.35.0-1ubuntu2.20+esm21
- 7.35.0-1ubuntu2.20+esm22
- 7.35.0-1ubuntu2.20+esm23
- 7.35.0-1ubuntu2.20+esm24
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
curl Ubuntu:Pro:16.04:LTS
- Versions
- 7.43.0-1ubuntu2
- 7.45.0-1ubuntu1
- 7.46.0-1ubuntu1
- 7.47.0-1ubuntu1
- 7.47.0-1ubuntu2
- 7.47.0-1ubuntu2.1
- 7.47.0-1ubuntu2.2
- 7.47.0-1ubuntu2.3
- 7.47.0-1ubuntu2.4
- 7.47.0-1ubuntu2.5
- 7.47.0-1ubuntu2.6
- 7.47.0-1ubuntu2.7
- 7.47.0-1ubuntu2.8
- 7.47.0-1ubuntu2.9
- 7.47.0-1ubuntu2.11
- 7.47.0-1ubuntu2.12
- 7.47.0-1ubuntu2.13
- 7.47.0-1ubuntu2.14
- 7.47.0-1ubuntu2.15
- 7.47.0-1ubuntu2.16
- 7.47.0-1ubuntu2.18
- 7.47.0-1ubuntu2.19
- 7.47.0-1ubuntu2.19+esm1
- 7.47.0-1ubuntu2.19+esm2
- 7.47.0-1ubuntu2.19+esm3
- 7.47.0-1ubuntu2.19+esm4
- 7.47.0-1ubuntu2.19+esm5
- 7.47.0-1ubuntu2.19+esm6
- 7.47.0-1ubuntu2.19+esm7
- 7.47.0-1ubuntu2.19+esm8
- 7.47.0-1ubuntu2.19+esm9
- 7.47.0-1ubuntu2.19+esm10
- 7.47.0-1ubuntu2.19+esm11
- 7.47.0-1ubuntu2.19+esm12
- 7.47.0-1ubuntu2.19+esm13
- 7.47.0-1ubuntu2.19+esm15
- 7.47.0-1ubuntu2.19+esm16
- 7.47.0-1ubuntu2.19+esm17
- 7.47.0-1ubuntu2.19+esm18
- 7.47.0-1ubuntu2.19+esm20
- 7.47.0-1ubuntu2.19+esm21
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
curl Ubuntu:Pro:18.04:LTS
- Versions
- 7.55.1-1ubuntu2
- 7.55.1-1ubuntu2.1
- 7.57.0-1ubuntu1
- 7.58.0-2ubuntu1
- 7.58.0-2ubuntu2
- 7.58.0-2ubuntu3
- 7.58.0-2ubuntu3.1
- 7.58.0-2ubuntu3.2
- 7.58.0-2ubuntu3.3
- 7.58.0-2ubuntu3.5
- 7.58.0-2ubuntu3.6
- 7.58.0-2ubuntu3.7
- 7.58.0-2ubuntu3.8
- 7.58.0-2ubuntu3.9
- 7.58.0-2ubuntu3.10
- 7.58.0-2ubuntu3.12
- 7.58.0-2ubuntu3.13
- 7.58.0-2ubuntu3.14
- 7.58.0-2ubuntu3.15
- 7.58.0-2ubuntu3.16
- 7.58.0-2ubuntu3.17
- 7.58.0-2ubuntu3.18
- 7.58.0-2ubuntu3.19
- 7.58.0-2ubuntu3.20
- 7.58.0-2ubuntu3.21
- 7.58.0-2ubuntu3.22
- 7.58.0-2ubuntu3.23
- 7.58.0-2ubuntu3.24
- 7.58.0-2ubuntu3.24+esm1
- 7.58.0-2ubuntu3.24+esm2
- 7.58.0-2ubuntu3.24+esm3
- 7.58.0-2ubuntu3.24+esm4
- 7.58.0-2ubuntu3.24+esm5
- 7.58.0-2ubuntu3.24+esm7
- 7.58.0-2ubuntu3.24+esm8
- 7.58.0-2ubuntu3.24+esm9
- 7.58.0-2ubuntu3.24+esm10
- 7.58.0-2ubuntu3.24+esm11
- 7.58.0-2ubuntu3.24+esm12
- 7.58.0-2ubuntu3.24+esm14
- 7.58.0-2ubuntu3.24+esm15
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
curl Ubuntu:Pro:20.04:LTS
- Versions
- 7.65.3-1ubuntu3
- 7.65.3-1ubuntu4
- 7.66.0-1ubuntu1
- 7.67.0-2ubuntu1
- 7.68.0-1ubuntu1
- 7.68.0-1ubuntu2
- 7.68.0-1ubuntu2.1
- 7.68.0-1ubuntu2.2
- 7.68.0-1ubuntu2.4
- 7.68.0-1ubuntu2.5
- 7.68.0-1ubuntu2.6
- 7.68.0-1ubuntu2.7
- 7.68.0-1ubuntu2.10
- 7.68.0-1ubuntu2.11
- 7.68.0-1ubuntu2.12
- 7.68.0-1ubuntu2.13
- 7.68.0-1ubuntu2.14
- 7.68.0-1ubuntu2.15
- 7.68.0-1ubuntu2.16
- 7.68.0-1ubuntu2.18
- 7.68.0-1ubuntu2.19
- 7.68.0-1ubuntu2.20
- 7.68.0-1ubuntu2.21
- 7.68.0-1ubuntu2.22
- 7.68.0-1ubuntu2.23
- 7.68.0-1ubuntu2.24
- 7.68.0-1ubuntu2.25
- 7.68.0-1ubuntu2.25+esm2
- 7.68.0-1ubuntu2.25+esm3
- 7.68.0-1ubuntu2.25+esm4
- 7.68.0-1ubuntu2.25+esm5
- 7.68.0-1ubuntu2.25+esm6
- 7.68.0-1ubuntu2.25+esm7
- 7.68.0-1ubuntu2.25+esm9
- 7.68.0-1ubuntu2.25+esm10
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
curl Ubuntu:22.04:LTS
- Versions
- 7.74.0-1.3ubuntu2
- 7.74.0-1.3ubuntu3
- 7.80.0-3
- 7.81.0-1
- 7.81.0-1ubuntu1.1
- 7.81.0-1ubuntu1.2
- 7.81.0-1ubuntu1.3
- 7.81.0-1ubuntu1.4
- 7.81.0-1ubuntu1.6
- 7.81.0-1ubuntu1.7
- 7.81.0-1ubuntu1.8
- 7.81.0-1ubuntu1.10
- 7.81.0-1ubuntu1.11
- 7.81.0-1ubuntu1.13
- 7.81.0-1ubuntu1.14
- 7.81.0-1ubuntu1.15
- 7.81.0-1ubuntu1.16
- 7.81.0-1ubuntu1.17
- 7.81.0-1ubuntu1.18
- 7.81.0-1ubuntu1.19
- 7.81.0-1ubuntu1.20
- 7.81.0-1ubuntu1.21
- 7.81.0-1ubuntu1.22
- 7.81.0-1ubuntu1.23
- Affected ranges
- ECOSYSTEM: < 7.81.0-1ubuntu1.24
Update to 7.81.0-1ubuntu1.24
curl Ubuntu:24.04:LTS
- Versions
- 8.2.1-1ubuntu3
- 8.2.1-1ubuntu3.1
- 8.4.0-2ubuntu1
- 8.5.0-2ubuntu1
- 8.5.0-2ubuntu2
- 8.5.0-2ubuntu8
- 8.5.0-2ubuntu9
- 8.5.0-2ubuntu10
- 8.5.0-2ubuntu10.1
- 8.5.0-2ubuntu10.2
- 8.5.0-2ubuntu10.3
- 8.5.0-2ubuntu10.4
- 8.5.0-2ubuntu10.5
- 8.5.0-2ubuntu10.6
- 8.5.0-2ubuntu10.7
- 8.5.0-2ubuntu10.8
- Affected ranges
- ECOSYSTEM: < 8.5.0-2ubuntu10.9
Update to 8.5.0-2ubuntu10.9
curl Ubuntu:25.10
- Versions
- 8.12.1-3ubuntu1
- 8.13.0-5ubuntu1
- 8.14.1-1ubuntu2
- 8.14.1-1ubuntu3
- 8.14.1-2ubuntu1
- 8.14.1-2ubuntu1.1
- 8.14.1-2ubuntu1.2
- Affected ranges
- ECOSYSTEM: < 8.14.1-2ubuntu1.3
Update to 8.14.1-2ubuntu1.3
curl Ubuntu:26.04:LTS
- Versions
- 8.14.1-2ubuntu1
- 8.17.0-1ubuntu1
- 8.18.0-1ubuntu1
- 8.18.0-1ubuntu2
- Affected ranges
- ECOSYSTEM: < 8.18.0-1ubuntu2.1
Update to 8.18.0-1ubuntu2.1