EulerOS Virtualization 2.12.1 : curl (EulerOS-SA-2026-3580)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check...

POC-CVE-2023-32681

POC pour CVE-2023-32681 Ceci est une implémentation Python 3 de CVE-2023-32681, affectant les clients utilisant la version = 2.30.0 de la bibliothèque requests. Selon https://www.rfc-editor.org/rfc/rfc9110.htmlsection-15.4, lorsqu'une redirection 3xx est émise par le serveur, l'agent utilisateur...

CVE-2026-85719

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

CVE-2026-85719

AsyncHttpClient (AHC) , a Java library for asynchronous HTTP requests, contains a credential-exposure flaw in its SOCKS proxy handling. NettyRequestFactory and NettyRequestSender attach the Proxy-Authorization header without verifying the request is actually being sent to an HTTP proxy, so creden...

axios: Axios: Information disclosure of proxy credentials via HTTP redirects

A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 2.0) is affected by an information disclosure vulnerability due to urllib3

Summary urllib3 is used by IBM Cloud Pak for Data System 2.0 as an HTTP client library for Python applications. When HTTP requests are sent without using proxy support, urllib3 versions prior to 1.26.19 and 2.2.2 do not treat the Proxy-Authorization header as sensitive authentication material and...

CVE-2026-67339

A flaw was found in guzzlehttp/guzzle, where it fails to properly isolate Proxy-Authorization headers from origin servers when using cURL handlers. A remote attacker could exploit this vulnerability when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as...

Astra Linux – Vulnerability in requests

Requests is an HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This issue arises due to the way we use rebuildproxies to reattach the Proxy-Authorization header to requests. For HTTP connections...

Astra Linux – Vulnerability in curl

Successfully using libcurl to perform a transfer over a specific HTTP proxy proxyA with Digest authentication. Then, changing the proxy host to another one proxyB for a second transfer, while reusing the same handle, causes libcurl to incorrectly pass the Proxy-Authorization: header field meant f...

Astra Linux – Vulnerability in python-urllib3

urllib3 is a user-friendly HTTP client library for Python. When using urllib3’s proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3’s proxy support, it’s possible to accidental...

curl: Information disclosure due to uncleared proxy authentication state

A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of Proxy-Authorization headers to an incorrec...

next.js: Next.js: Unauthorized access to protected content via middleware bypass

A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows acces...

MGASA-2026-0327 Updated python-starlette package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. CVE-2024-28849 Starlette vulnerable to On^2 DoS via Range header merging in starlette.responses.FileResponse. CVE-2025-62727 Security restriction bypass via malformed HTTP Host header. CVE-2026-48710...

JLSEC-2026-1210 Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest**...

Successfully using libcurl to do a transfer over a specific HTTP proxy proxyA with Digest authentication and then changing the proxy host to a second one proxyB for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Proxy-Authorization: header field meant for proxyA, to...

Information Disclosure axios Dependency in Jira Service Management Data Center

This High severity Information Disclosure vulnerability was introduced in versions 5.17.2, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.2...

GHSA-32RQ-JHR7-M3HH Duplicate Advisory: Guzzle: Proxy-Authorization headers can be sent to origin servers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-94pj-82f3-465w. This link is maintained to preserve external references. Original Description guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in...

CVE-2026-67339

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...

CVE-2026-67339

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...

CVE-2026-67339 guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...