83 matches found
CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CVE-2026-86414
libcurl is vulnerable to a credential leak where an HTTP proxy can trick the library into sending the origin's credentials (such as Basic password or Negotiate/Kerberos tickets ) to the proxy itself. This occurs because the proxy can respond to a CONNECT tunnel request with a 401 WWW-Authenticate...
EUVD-2026-105306
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the "CONNECT" tunnel request with 401 "WWW-Authenticate:" instead of the expected 407 "Proxy-Authenticate:"...
CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
Red Hat: CVE-2026-86414: curl: curl: leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
SUSE CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CURL-CVE-2026-86414 leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CVE-2026-86414
A HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
UBUNTU-CVE-2026-86414
A HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
PT-2026-113742
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An HTTP proxy can trick libcurl into sending the origin's credentials, such as Basic passwords or Negotiate/Kerberos tickets, directly to the proxy. This occurs when the proxy responds to a...
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to th...
GHSA-3WP9-XFWM-RJJF AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to th...
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
Impact When a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at the original host. Four consumers read that stale value, and each one sends the first host's request, credentials, or both to the second host. A replay...
CVE-2026-107285
The AsyncHttpClient (AHC) library, used by Java applications, contains a vulnerability in versions prior to 3.0.12 and 2.16.1 . The root cause lies in how NettyRequestFactory.newNettyRequest and requestUri determine whether to attach proxy authentication; because ws is not marked as secure, tunne...
CVE-2026-107285 AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...
CVE-2026-107285 AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...
EUVD-2026-78166
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...