curl: Information disclosure due to uncleared proxy authentication state

A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of Proxy-Authorization headers to an incorrec...

Important: Red Hat Security Advisory: curl security, bug fix, and enhancement update

An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Directory Traversal

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Directory Traversal via insufficient validation of request body parameters in the proxy authentication layer, allowing an authenticated attacker to inject banned parameters...

Sensitive Information Disclosure

org.asynchttpclient, async-http-client is vulnerable to sensitive information disclosure. The vulnerability is due to improper handling of proxy authentication headers when using an authenticated SOCKS proxy, which allows an attacker-controlled origin to obtain proxy credentials, including Basic,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142299)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142299 advisory. SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system...

curl: curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status line

Summary In the HTTP/1.1 proxy-CONNECT response parser lib/cf-h1-proxy.c, singleheader, the per-line counter data-req.headerline a.k.a. k-headerline is never incremented — only the tunnel-local ts-headerlines is. Curlreqsoftreset resets k-headerline to 0 before the CONNECT exchange begins, and it...

OESA-2026-4388 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: SoupAuthManager caches proxy authentication credentials without scoping them to...

CVE-2026-77711

A flaw was found in Eclipse Jetty's HttpClient. A malicious destination server can cause an information disclosure of proxy authentication credentials when client requests are routed through a forward proxy. By returning a proxy authentication challenge, the server misleads the client into...

Linux Distros Unpatched Vulnerability : CVE-2026-77711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly...

Astra Linux – vulnerability in libsoup2.4

SoupAuthManager caches proxy authentication credentials without restricting them to the specific proxy authority host:port. When the proxy configuration changes—for example, via system settings or WPAD—the cached Proxy-Authorization headers from the previous proxy are sent to the new proxy,...

Information Exposure

Overview org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Information Exposure in the HttpClient. An attacker can obtain proxy authentication credentials by crafting a server that responds with a 407...

DEBIAN-CVE-2026-77711

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

CVE-2026-77711

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

EUVD-2026-101947

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

CVE-2026-77711

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

CVE-2026-77711

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

CVE-2026-77711

The Jetty HttpClient component is vulnerable to a credential exposure flaw when making requests through a forward proxy . If a server responds with a 407 (Proxy Authentication Required) , the client mistakenly treats this response as originating from the proxy rather than the destination server. ...

CVE-2026-77711

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

CVE-2026-77711

When Jetty's "HttpClient" make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the "Proxy-Authentication" header, which arrives to the...

CVE-2026-77711

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...