A HTTP proxy can trick libcurl into sending the origin's credentials (Basic
password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering
the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the
expected 407 `Proxy-Authenticate:`.

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-86414 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.10.8 to and including 8.22.0
- Not affected versions: curl < 7.10.8 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/52ceab5e41a01b4d1227876

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/2956af6c7451029fb12c12f8166

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid HTTP proxies

TIMELINE
--------

This issue was reported to the curl project on September 3, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Stefan Eissing

Thanks a lot!