Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-29 | 1 | General1 |
| 2026-04-30 | 2 | Disclosure1General1 |
| 2026-05-02 | 1 | Disclosure1 |
| 2026-05-11 | 2 | Patch2 |
kusanagi-curl モジュール更新情報 8.20.0-1 https://kusanagi.tokyo/releases/24476/ KUSANAGI 9 を構成している各モジュールのアップデートを行いました。 アップデートにより適用される各モジュールのバージョンは、以下のとおりとなります。 curl 8.20.0-1 この更新には脆弱性(CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, CVE-2026-6253, CVE-2026-5773, CVE-2026-5545, CVE-2...
Post summary
Kusanagi updated its curl module to patch multiple CVEs, providing a remediation for the mentioned vulnerabilities.
⚡ CVE-2026-6253: proxy credentials leak over redirect-to proxy 👨🏻💻 joesephdiver ➟ curl 🟧 Medium 💰 None 🔗 https://hackerone.com/reports/3669637 #bugbounty #bugbountytips #cybersecurity #infosec https://t.co/PVaoZQxd56
Post summary
A new medium‐severity vulnerability, CVE‑2026‑6253, leaking proxy credentials via redirect-to‑proxy was disclosed with a HackerOne report link; no exploitation, patch, or debunking information is present.
curl CVE-2026-6253: proxy credentials leak over redirect-to proxy CVE-2026-7009: OCSP stapling bypass with Apple SecTrust CVE-2026-6276: stale custom cookie host causes cookie leak CVE-2026-7168: cross-proxy Digest auth state leak 2/2
Post summary
The passage simply lists four newly disclosed curl CVEs with brief impact descriptions, providing no proof of concept, exploit code, active exploitation, or patch details.
CVE-2026-6253 [ADVISORY] curl https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6253
Post summary
The text merely references an advisory link for CVE‑2026‑6253 without offering additional details.
kusanagi-curl Module Update 8.20.0-1 https://kusanagi.tokyo/en/releases/24477/ KUSANAGI 9 modules have been updated. The updated modules are as follows: curl 8.20.0-1 This update includes support for vulnerability(CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, CVE-2026-6253,...
Post summary
The Kusanagi 9 modules were updated to address multiple CVE-2026 vulnerabilities. The release notes list the CVE IDs but do not provide PoC or exploit details.
curlで8件の脆弱性 CVE-2026-7168 CVE-2026-7009 CVE-2026-6429 CVE-2026-6276 CVE-2026-6253 CVE-2026-5773 CVE-2026-5545 CVE-2026-4873 Published vulnerabilities for curl/libcurl https://curl.se/docs/security.html
Post summary
The text announces eight newly published curl/libcurl vulnerabilities and links to curl's security documentation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | haxx | curl | - | - | - |