What is CVE-2026-9079?

CVE-2026-9079 is a critical-severity vulnerability in Curl, classified under Insufficiently Protected Credentials. CVSS score: 9.8/10. Published 2026-07-03.

How severe is CVE-2026-9079?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Curl

CVE-2026-9079

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

EPSS: 0.006 (44.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Curl — versions 8.20.0, 8.19.0, 8.18.0
Haxx Curl

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

2499f714-1537-4658-8207-48ae4bb9eae9 (Vendor Advisory)
2499f714-1537-4658-8207-48ae4bb9eae9 (Patch, Vendor Advisory)
2499f714-1537-4658-8207-48ae4bb9eae9 (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2026-9079?: CVE-2026-9079 is a critical-severity vulnerability in Curl, classified under Insufficiently Protected Credentials. CVSS score: 9.8/10. Published 2026-07-03.
How severe is CVE-2026-9079?: Critical severity. CVSS v3 base score is 9.8 out of 10.