CVE-2026-6253

A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials.

Moderate: This flaw in curl and libcurl allows proxy credentials to be inadvertently exposed to a second proxy during a redirect. This issue arises when curl is configured to use distinct proxies for different URL schemes, the initial proxy requires authentication, and a subsequent proxy does not. Red Hat products utilizing curl or libcurl in such a specific proxy chaining configuration may be affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid configuring curl or libcurl to use proxies that require credentials. This prevents the scenario where credentials for a first proxy could be inadvertently passed to a second proxy during a redirect.