PT-2026-35894 · Curl+2 · Curl+2

Daniel Stenberg · Published 2026-04-29 · Updated 2026-06-05 · CVE-2026-6253

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description curl may erroneously pass credentials intended for a first proxy to a second proxy. This occurs when curl is configured to use different proxies for different URL schemes, the first proxy requires credentials, the second proxy does not, and curl is redirected from a URL using the first proxy's scheme (e.g., http://) to a URL using a different scheme (e.g., https://) that utilizes the second proxy.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-6253

ECHO-E31E-7E52-E694

OESA-2026-2477

OPENSUSE-SU-2026:10674-1

RHSA-2026:12916

USN-8227-1

Affected Products

Linuxmint

Ubuntu

Curl

References · 44

• 🔥 https://hackerone.com/reports/3669637 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6253 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-6253 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-7168 · Vendor Advisory
• https://osv.dev/vulnerability/CURL-CVE-2026-6253 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-6253 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8227-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4873 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5545 · Vendor Advisory
• https://curl.se/docs/CVE-2026-6253.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6253 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-6253 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-7168 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6276 · Security Note
• https://curl.se/docs/CVE-2026-6253.json · Vendor Advisory