Login Request a demo
Critical severity · published Jul 3, 2026
CVE-2026-9079
stale proxy password leak
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
curl · curl
8.8.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; d5e83eb745762f48d8fafadc5df5dd3ae8d8941e before 88c7e16cceec816a2df45c899d49b1e85513f193; 8.20.0; 8.19.0; +16 more · source: vendor, NVD
In the news
VulnerabilityHigh
Hitachi Energy RTU500 Product
View CSAF Summary Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy RTU500 Product are affected: RTU500 series CMU Firmware vers:RTU500_series_CMU_Firmware/>=13.5.1|<=13.5.4, vers:RTU500_series_CMU_Firmware/>=13.6.1|<=13.6.3, vers:RTU500_series_CMU_Firmware/>=13.7.1|<=13.7.8, vers:RTU500_series_CMU_Firmware/>=13.8.1|<=13.8.2, vers:RTU500_series_CMU_Firmware/>=12.7.1|<=12.7.7 (CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6653) CVSS Vendor Equipment v3 8.8 Hitachi Energy RTU500 series CMU Firmware 7 Vulnerabilities NULL Pointer Dereference, ...
CVE-2026-17539CVE-2026-28388CVE-2026-6732
Oct 20, 2026·US-CERT ICS Advisories
Affected product
CU
curl
curl
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9079
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9079
Patch
https://curl.se/docs/CVE-2026-9079.html
Vendor Advisory
https://curl.se/docs/CVE-2026-9079.json
Exploit
https://hackerone.com/reports/3750295
More from curl
9.8
CVE-2026-19931
Negotiate ambient user conn reuse
9.8
CVE-2026-8925
SASL double-free
9.8
CVE-2026-11856
cross-origin Digest auth state leak
9.8
CVE-2026-10536
HTTP/2 stream-dependency tree UAF
9.8
CVE-2023-38545
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake