HTTP Proxy Authentication Bypass in curl via Connection Reuse

Executive Summary

CVE-2026-3784 is a vulnerability in curl where the software incorrectly reuses an existing HTTP proxy connection when performing a CONNECT request to a server.

Specifically, curl would reuse a proxy connection even if the new request uses different credentials for the HTTP proxy, which is improper behavior.

The correct behavior is to create or use a separate connection for requests with different proxy credentials to prevent authentication bypass.

This flaw is classified under CWE-305: Authentication Bypass by Primary Weakness and has a low severity rating.

Useful 0 Not Useful 0

Detection Guidance

There is no specific information provided in the resources about commands or methods to detect this vulnerability on your network or system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to an authentication bypass because curl reuses an HTTP proxy connection even when different credentials are provided.

As a result, unauthorized access to proxy resources could occur if different credentials are expected to isolate connections.

This could potentially allow an attacker to use an existing proxy connection without proper authentication, undermining security controls.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-3784 vulnerability in curl, the recommended steps are:

• Upgrade curl and libcurl to version 8.19.0 or later, where the vulnerability is fixed.
• If upgrading is not immediately possible, apply the patch provided for the vulnerability and rebuild libcurl.
• Avoid using HTTP proxies with alternating credentials to prevent the improper reuse of proxy connections.

Useful 0 Not Useful 0