What is CVE-2026-9079?

CVE-2026-9079 is a critical-severity vulnerability in Curl, classified under Insufficiently Protected Credentials. CVSS score: 9.8/10. Published 2026-07-03.

How severe is CVE-2026-9079?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Curl

CVE-2026-9079

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Published 2026-07-03 · last modified 2026-09-15.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.006 (45.9th percentile), scored 2026-10-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 45.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.011 · newest: 0.006 · change: -0.005

Affected products

Curl — versions 8.20.0, 8.19.0, 8.18.0
Haxx Curl

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

2499f714-1537-4658-8207-48ae4bb9eae9 (Vendor Advisory)
2499f714-1537-4658-8207-48ae4bb9eae9 (Patch, Vendor Advisory)
2499f714-1537-4658-8207-48ae4bb9eae9 (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2026-9079?: CVE-2026-9079 is a critical-severity vulnerability in Curl, classified under Insufficiently Protected Credentials. CVSS score: 9.8/10. Published 2026-07-03.
How severe is CVE-2026-9079?: Critical severity. CVSS v3 base score is 9.8 out of 10.