Bug 2461202 (CVE-2026-6253)

Summary: CVE-2026-6253 curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, bbrownin, crizzo, csutherl, dbosanac, dpaolell, jclere, jdelft, jmitchel, jreimann, jupierce, kaycoth, kshier, lgarciaa, mbiarnes, mdessi, mrizzi, pcattana, pjindal, plodge, ppalepu, ppostler, prdhamdh, rekumar, rhel-process-autobot, sdawley, security-response-team, sghai, sidsharm, stcannon, suppawar, szappis, teagle, vchlup, vlaad, vvoronko, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management (CWE-522) may allow an attacker to gain unauthorized access or information by intercepting these disclosed credentials.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-04-29   

Description OSIDB Bzimport 2026-04-23 16:48:26 UTC 
A flaw was found in curl. When curl is configured to use specific proxies for different URL schemes, and a redirect occurs from a URL using a credentialed proxy to a URL using a non-credentialed proxy, curl may inadvertently send the credentials of the first proxy to the second. This can lead to the unauthorized disclosure of proxy credentials (CWE-522), potentially allowing an attacker to gain unauthorized access or information.
Comment 6 Jon Orris 2026-10-12 02:53:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:80512 https://access.redhat.com/errata/RHSA-2026:80512
Comment 7 Jon Orris 2026-10-14 13:57:44 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services 2.4.62.SP5

Via RHSA-2026:56869 https://access.redhat.com/errata/RHSA-2026:56869