CVE-2026-8927: Haxx Curl

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

Affected products

• Haxx Curl: from 7.12.0, before 8.21.0 (fixed in 8.21.0)

Published 2026-07-03. Last modified 2026-09-15.