{
  "threat_severity" : "Important",
  "public_date" : "2026-07-03T06:16:06Z",
  "bugzilla" : {
    "description" : "curl: Information disclosure due to uncleared proxy authentication state",
    "id" : "2496769",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2496769"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-201",
  "details" : [ "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of `Proxy-Authorization` headers to an incorrect proxy, potentially exposing sensitive authentication information to an unauthorized entity. This is an information disclosure vulnerability." ],
  "statement" : "This Important information disclosure vulnerability in libcurl arises when a handle is reused for sequential transfers with environment-variable proxy configurations, failing to clear the proxy authentication state. This oversight can lead to `Proxy-Authorization` headers being inadvertently sent to an incorrect proxy, potentially exposing sensitive authentication information in Red Hat environments utilizing multiple proxy configurations. This flaw leads only to a confidentiality impact. There has been no observed integrity impact.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-17T00:00:00Z",
    "advisory" : "RHSA-2026:55432",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "curl-0:8.12.1-4.el10_2.4"
  }, {
    "product_name" : "Red Hat JBoss Core Services 2.4.62.SP5",
    "release_date" : "2026-08-19T00:00:00Z",
    "advisory" : "RHSA-2026:56869",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1",
    "package" : "libcurl-1.dll"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-24T00:00:00Z",
    "advisory" : "RHSA-2026:29017",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "curl-main-8.21.0-0.1.hum1",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-02T00:00:00Z",
    "advisory" : "RHSA-2026:34975",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "rust-main-1.96.1-1.hum1",
    "impact" : "important"
  } ],
  "package_state" : [ {
    "product_name" : "Confidential Compute Attestation",
    "fix_state" : "Affected",
    "package_name" : "build-of-trustee/trustee-rhel9",
    "cpe" : "cpe:/a:redhat:confidential_compute_attestation:1"
  }, {
    "product_name" : "Confidential Compute Attestation",
    "fix_state" : "Affected",
    "package_name" : "openshift-sandboxed-containers/osc-podvm-payload-rhel9",
    "cpe" : "cpe:/a:redhat:confidential_compute_attestation:1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "igvm",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "rust",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "s390utils",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "snphost",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "trustee",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "trustee-guest-components",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Affected",
    "package_name" : "curl",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "curl",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "curl",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "curl",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "rust",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "snphost",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "trustee-guest-components",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3",
    "fix_state" : "Affected",
    "package_name" : "rust",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Will not fix",
    "package_name" : "libcurl.so",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift/ose-rhel-coreos-8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces",
    "fix_state" : "Affected",
    "package_name" : "devspaces/code-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3"
  }, {
    "product_name" : "Red Hat Trusted Profile Analyzer",
    "fix_state" : "Not affected",
    "package_name" : "rhtpa/rhtpa-trustification-service-rhel9",
    "cpe" : "cpe:/a:redhat:trusted_profile_analyzer:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-8927\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-8927\nhttps://curl.se/docs/CVE-2026-8927.html\nhttps://curl.se/docs/CVE-2026-8927.json\nhttps://hackerone.com/reports/3744543" ],
  "name" : "CVE-2026-8927",
  "mitigation" : {
    "value" : "To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies.",
    "lang" : "en:us"
  },
  "csaw" : false
}