CVE-2026-8927 env-set cross-proxy Digest auth state leak

Critical 9.1 Published 3 Jul 2026 Updated 15 Sep 2026

libcurl leaks proxy authentication headers between sequential transfers, exposing credentials to unintended proxies.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-8927?

CVE-2026-8927 is a critical vulnerability in Haxx Curl, published on 3 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

Weakness: CWE-294

Which versions are affected by CVE-2026-8927?

It affects 1 product.

Linux distribution packages (13)

`curl` AlmaLinux:10	All versions	`8.12.1-4.el10_2.4`
`libcurl` AlmaLinux:10	All versions	`8.12.1-4.el10_2.4`
`libcurl-devel` AlmaLinux:10	All versions	`8.12.1-4.el10_2.4`
`libcurl-minimal` AlmaLinux:10	All versions	`8.12.1-4.el10_2.4`
`curl` Red Hat:enterprise_linux:10.2	All versions	`0:8.12.1-4.el10_2.4`
`curl-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:8.12.1-4.el10_2.4`
`curl-debugsource` Red Hat:enterprise_linux:10.2	All versions	`0:8.12.1-4.el10_2.4`
`libcurl` Red Hat:enterprise_linux:10.2	All versions	`0:8.12.1-4.el10_2.4`
`libcurl-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:8.12.1-4.el10_2.4`
`libcurl-devel` Red Hat:enterprise_linux:10.2	All versions	`0:8.12.1-4.el10_2.4`
`libcurl-minimal` Red Hat:enterprise_linux:10.2	All versions	`0:8.12.1-4.el10_2.4`
`libcurl-minimal-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:8.12.1-4.el10_2.4`
`curl` Rocky Linux:10	All versions	`0:8.12.1-4.el10_2.4`

Products include Haxx Curl.

How do I fix CVE-2026-8927?

Upgrade to a fixed version.

Is CVE-2026-8927 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8927 exists.

All Haxx Curl vulnerabilities

Sources

Also known as ALPINE-CVE-2026-8927, ALSA-2026:55432, AZL-91788, AZL-91833, BELL-CVE-2026-8927, CLSA-2026-1784193045 and 16 more.