Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-jr4f-4564-w3mr

Опубликовано: 03 июл. 2026
Источник: github
Github: Не прошло ревью
CVSS3: 9.1

Описание

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

EPSS

Процентиль: 51%
0.00752
Низкий

9.1 Critical

CVSS3

Дефекты

CWE-294

Связанные уязвимости

CVSS3: 9.1
ubuntu
28 дней назад

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

CVSS3: 7.5
redhat
28 дней назад

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

CVSS3: 9.1
nvd
28 дней назад

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

CVSS3: 5.3
msrc
25 дней назад

env-set cross-proxy Digest auth state leak

CVSS3: 9.1
debian
28 дней назад

When reusing a libcurl handle for sequential transfers driven by envir ...

EPSS

Процентиль: 51%
0.00752
Низкий

9.1 Critical

CVSS3

Дефекты

CWE-294