libcurl vulnerability

Microsoft’s MSRC entry for CVE-2026-9079 puts a name on a curl/libcurl flaw disclosed in late June 2026: a stale proxy password leak in which libcurl could keep old proxy authentication credentials after being told to clear them, then reuse them on a later transfer that should not have had them...

CVE-2026-7168 is a medium-severity libcurl vulnerability disclosed by the curl project on April 29, 2026, in which applications reusing a libcurl handle across two different HTTP proxies can leak a Digest Proxy-Authorization header from the first proxy to the second. It is not a Windows...

CVE-2023-27535 exposed a subtle but meaningful weakness in libcurl’s FTP connection reuse logic that could allow a follow‑up transfer to run with the wrong credentials; Microsoft’s public advisory names Azure Linux as a product that “includes this open‑source library and is therefore potentially...