CVE-2026-9079
CRITICALCVSS 9.8/10EPSS 1.06%
Last modified
CVE-2026-9079 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.. EPSS estimates a 1.06% chance of exploitation in the next 30 days.
Description
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | >= 8.8.0, < 8.21.0 |
References
- https://curl.se/docs/CVE-2026-9079.htmlPatch, Vendor Advisory
- https://curl.se/docs/CVE-2026-9079.jsonVendor Advisory
- https://hackerone.com/reports/3750295Exploit, Issue Tracking, Third Party Advisory
- https://hackerone.com/reports/3750295Exploit, Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-9079?
libcurl had a flaw that when instructed to clear proxy authentication
credentials which made it not do so, leaving the old credentials around to get
used for subsequent transfers that should not know nor use them.
How severe is CVE-2026-9079?
CVE-2026-9079 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.06% probability of exploitation in the next 30 days.
How do I fix CVE-2026-9079?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-90784A vulnerability has been found in Dvidelabs flatcc up to 0.6…5.3
- CVE-2026-90785A vulnerability was found in Dvidelabs flatcc up to 0.6.3. T…5.3
- CVE-2026-90786A vulnerability was determined in Dvidelabs flatcc up to 0.6…5.3
- CVE-2026-90787A vulnerability was identified in Soarkey StudentManagement …7.3
- CVE-2026-90788A security flaw has been discovered in magicblack MacCMS10 2…4.7
- CVE-2026-90789A weakness has been identified in itsourcecode Leave Managem…7.3
- CVE-2026-90790A security vulnerability has been detected in a2aproject a2a…6.3
- CVE-2026-90791A vulnerability was detected in GPAC up to f1219cde. This vu…6.3
- CVE-2026-90792A flaw has been found in GPAC up to f1219cde. This issue aff…4.3
- CVE-2026-90793A vulnerability has been found in GPAC up to f1219cde. Impac…5.4
- CVE-2026-90794A vulnerability was found in GPAC up to f1219cde. The affect…6.3
- CVE-2026-90795A vulnerability was determined in itsourcecode Loan Manageme…4.3
Are you affected by CVE-2026-9079?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST