124 matches found
CVE-2025-51471-POC
CVE-2025-51471 - Ollama Cross-Domain Token Exposure PoC Author: ajtazer 🔥 Overview This repository contains a Proof of Concept PoC for CVE-2025-51471 , a Cross-Domain Authentication Token Exposure vulnerability that affects all versions of Ollama including the latest. 📋 Vulnerability Description...
Curl 7.10.8 < 8.23.0 HTTP Proxy Credential Leak
The version of curl installed on the remote host is 7.10.8 prior to 8.23.0. It is, therefore, affected by an information disclosure vulnerability: - An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answeri...
AZL-109965 CVE-2026-86414 affecting package curl 8.11.1-11
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
AZL-110274 CVE-2026-86414 affecting package tensorflow 2.16.1-11
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
AZL-109923 CVE-2026-86414 affecting package cmake 3.30.3-15
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
AZL-110037 CVE-2026-86414 affecting package mysql 8.0.46-2
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
AZL-110175 CVE-2026-86414 affecting package rust 1.75.0-31
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
AZL-110202 CVE-2026-86414 affecting package rust 1.96.1-2
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
ALPINE-CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CVE-2026-86414
libcurl is vulnerable to a credential leak where an HTTP proxy can trick the library into sending the origin's credentials (such as Basic password or Negotiate/Kerberos tickets ) to the proxy itself. This occurs because the proxy can respond to a CONNECT tunnel request with a 401 WWW-Authenticate...
EUVD-2026-105306
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CVE-2026-86414 leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the "CONNECT" tunnel request with 401 "WWW-Authenticate:" instead of the expected 407 "Proxy-Authenticate:"...
CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
Red Hat: CVE-2026-86414: curl: curl: leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
curl information leakage vulnerability
The curl version 8.22.0 and earlier have a vulnerability related to information leakage. This vulnerability arises from the HTTP proxy’s use of the 401 WWW-Authenticate response to CONNECT tunnel requests, instead of the expected 407 Proxy-Authenticate response. This allows licurl to send the...
SUSE CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...
DEBIAN-CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...