JLSEC-2026-1210 Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with Digest...

🗓️ 07 Aug 2026 20:11:58Reported by GoogleType

osv🔗 osv.dev👁 7 Views

libcurl uses Digest proxyA, then switches to proxyB with the same handle, sending proxyA's Proxy-Authorization to proxyB.

Reporter	Title	Published	Views	Family All 77
ATTACKERKB	CVE-2026-7168	13 May 202608:29	–	attackerkb
AlpineLinux	CVE-2026-7168	13 May 202608:29	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in curl	1 Nov 202510:54	–	astralinux
BDU FSTEC	The vulnerability of the libcurl library in software applications for interacting with servers via cURL allows a hacker to gain unauthorized access to protected information.	15 Jul 202600:00	–	bdu_fstec
Broadcom	Multiples vulnerabilities in Curl	28 Jul 202600:00	–	broadcom
CBLMariner	CVE-2026-7168 affecting package curl for versions less than 8.11.1-7	5 Jun 202612:59	–	cbl_mariner
Circl	CVE-2026-7168	29 Apr 202606:47	–	circl
CNNVD	curl 安全漏洞	13 May 202600:00	–	cnnvd
curl security advisories	cross-proxy Digest auth state leak	29 Apr 202608:00	–	curl
CVE	CVE-2026-7168	13 May 202608:29	–	cve

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/04/29/14
curl	www.curl.se/docs/CVE-2026-7168.html
curl	www.curl.se/docs/CVE-2026-7168.json
github	www.github.com/advisories/GHSA-v92m-hrhj-gw54
hackerone	www.hackerone.com/reports/3697719
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-7168

07 Aug 2026 20:28Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.15.3

EPSS0.00471

JLSEC-2026-1210 Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest**...