curl: CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth

Summary When libcurl tunnels through an HTTP proxy with CONNECT HTTPS-over-proxy, the custom headers set via CURLOPTPROXYHEADER are sent to the proxy once, at tunnel-setup time lib/httpproxy.c:63-83. The connection-reuse decision for a proxied connection, however, does not take proxyheaders into...

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the proxy connection process. An attacker can intercept sensitive credentials by acting a...

curl: curl: Unauthorized access due to improper HTTP proxy connection reuse

A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

curl: curl: Unauthorized access due to improper HTTP proxy connection reuse

A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker...

EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-2879)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability, which was classified as problematic, has been found in cURL up to 8.19.0 Network Utility Software. Affected by this issue is some...

EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2026-2847)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers.libcurl features a pool of recent connections so th...

EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-2816)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers.libcurl features a pool of recent connections so th...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-2644)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections so that subsequent...

GCP Cloud SQL Connection Info Loot

Extract Cloud SQL connection endpoints, users, SSL material, and proxy connection strings !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud SQL Connection Info Loot", "description":...

PT-2026-55847

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish proxy connection function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves...

EulerOS Virtualization 2.13.1 : curl (EulerOS-SA-2026-2368)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcu...

EulerOS Virtualization 2.12.1 : curl (EulerOS-SA-2026-2072)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request.libcur...

EulerOS Virtualization 2.12.0 : curl (EulerOS-SA-2026-2097)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request.libcur...

OESA-2026-2505 rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files a...

OESA-2026-2502 rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files a...

SUSE CVE-2026-45232

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establishproxyconnection function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves...

Off-by-one Error

Overview Affected versions of this package are vulnerable to Off-by-one Error via the establishproxyconnection function. An attacker can corrupt stack memory by sending a specially crafted HTTP proxy response line of 1023 or more bytes without a newline terminator, potentially leading to...

CVE-2026-45232

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establishproxyconnection function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves...

CVE-2026-45232

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establishproxyconnection function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves...