CVE-2026-3784
HTTP Proxy Authentication Bypass in curl via Connection Reuse
Publication date: 2026-03-11
Last updated on: 2026-03-12
Assigner: curl
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| haxx | curl | From 7.7 (inc) to 8.18.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-305 | The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can lead to an authentication bypass because curl reuses an HTTP proxy connection even when different credentials are provided.
As a result, unauthorized access to proxy resources could occur if different credentials are expected to isolate connections.
This could potentially allow an attacker to use an existing proxy connection without proper authentication, undermining security controls.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided in the resources about commands or methods to detect this vulnerability on your network or system.
Can you explain this vulnerability to me?
CVE-2026-3784 is a vulnerability in curl where the software incorrectly reuses an existing HTTP proxy connection when performing a CONNECT request to a server.
Specifically, curl would reuse a proxy connection even if the new request uses different credentials for the HTTP proxy, which is improper behavior.
The correct behavior is to create or use a separate connection for requests with different proxy credentials to prevent authentication bypass.
This flaw is classified under CWE-305: Authentication Bypass by Primary Weakness and has a low severity rating.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-3784 vulnerability in curl, the recommended steps are:
- Upgrade curl and libcurl to version 8.19.0 or later, where the vulnerability is fixed.
- If upgrading is not immediately possible, apply the patch provided for the vulnerability and rebuild libcurl.
- Avoid using HTTP proxies with alternating credentials to prevent the improper reuse of proxy connections.