CVE-2026-6253

Publication date 29 April 2026

Last updated 29 April 2026


Ubuntu priority

Description

curl might erroneously pass on credentials for a first proxy to a second proxy.

Read the notes from the security team

Mitigation

Avoid using proxies with credentials.

Status

Package Ubuntu Release Status
curl 26.04 LTS resolute
Needs evaluation
25.10 questing
Vulnerable
24.04 LTS noble
Vulnerable
22.04 LTS jammy
Vulnerable
20.04 LTS focal
Vulnerable
18.04 LTS bionic
Vulnerable
16.04 LTS xenial
Vulnerable
14.04 LTS trusty
Vulnerable

Notes


ebarretto

Introduced-in: https://github.com/curl/curl/commit/3b60bb725913ce

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
curl

Access our resources on patching vulnerabilities