CVE-2026-3784 wrong proxy connection reuse with credentials
curl incorrectly reuses proxy connections with different credentials, allowing potential authentication bypass or credential leakage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3784?
CVE-2026-3784 is a medium-severity authentication bypass vulnerability in Haxx Curl, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.
Weakness: CWE-305
Which versions are affected by CVE-2026-3784?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-3784?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-3784 being exploited?
There is no known exploitation of CVE-2026-3784 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-3784, AZL-79679, BELL-CVE-2026-3784, CLSA-2026-1774273500, CLSA-2026-1774276586, CURL-CVE-2026-3784 and 8 more.