CVE-2015-3236 Information disclosure in n/a

What is CVE-2015-3236?

CVE-2015-3236 is a medium-severity vulnerability in Haxx Curl, published on 22 Jun 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.

Weakness: CWE-200

Which versions are affected by CVE-2015-3236?

It affects 2 products.

Products include Haxx Curl, Haxx Libcurl.

How do I fix CVE-2015-3236?

Upgrade to a fixed version.

Is CVE-2015-3236 being exploited?

There is no known exploitation of CVE-2015-3236 in the wild and no public exploit code.

Other vulnerabilities in Haxx Curl

• CVE-2026-19931 Negotiate ambient user conn reuse Critical 9.8
• CVE-2026-10536 HTTP/2 stream-dependency tree UAF Critical 9.8
• CVE-2026-11856 cross-origin Digest auth state leak Critical 9.8
• CVE-2026-8925 SASL double-free Critical 9.8
• CVE-2026-9079 stale proxy password leak Critical 9.8

All Haxx Curl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CURL-CVE-2015-3236, DEBIAN-CVE-2015-3236, GHSA-x247-6f29-259j.