Fluid Attacks Database

Description

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	curl	=8.14.1-2 \|\| =8.14.1-2+deb13u1 \|\| =8.14.1-2+deb13u2 \|\| =8.14.1-2+deb13u2~bpo13+1 \|\| =8.14.1-2+deb13u3 \|\| =8.14.1-2+deb13u4 \|\| =8.14.1-2+deb13u5 \|\| =8.14.1-2+exp1 \|\| =8.15.0-1 \|\| =8.15.0-1~bpo13+1 \|\| =8.15.0-1~exp1 \|\| =8.15.0~rc1-1exp1 \|\| =8.15.0~rc2-1~exp1 \|\| =8.15.0~rc3-1~exp1 \|\| =8.16.0-1 \|\| =8.16.0-1+exp1 \|\| =8.16.0-1~bpo13+1 \|\| =8.16.0-2 \|\| =8.16.0-3 \|\| =8.16.0-4 \|\| =8.16.0-4~bpo13+1 \|\| =8.16.0~rc1-1~exp1 \|\| =8.16.0~rc2-1 \|\| =8.16.0~rc2-2 \|\| =8.16.0~rc3-1 \|\| =8.17.0-1 \|\| =8.17.0-2 \|\| =8.17.0-3 \|\| =8.17.0~rc1-1~exp1 \|\| =8.17.0~rc2-1 \|\| =8.17.0~rc3-1 \|\| =8.18.0-1 \|\| =8.18.0-1~bpo13+1 \|\| =8.18.0-2 \|\| =8.18.0~rc1-1+exp1 \|\| =8.18.0~rc2-1 \|\| =8.18.0~rc3-1 \|\| =8.19.0-1 \|\| =8.19.0-1+exp1 \|\| =8.19.0-1~bpo13+1 \|\| =8.19.0-2 \|\| =8.19.0-3 \|\| =8.19.0-3+exp1 \|\| =8.19.0-3+exp2 \|\| =8.19.0~rc1-1~exp1 \|\| =8.19.0~rc2-1 \|\| =8.19.0~rc2-2 \|\| =8.19.0~rc3-1 \|\| =8.20.0-1 \|\| =8.20.0-1+exp \|\| =8.20.0-2 \|\| =8.20.0-2+exp1 \|\| =8.20.0-2~bpo13+1 \|\| =8.20.0-3 \|\| =8.20.0-4 \|\| =8.20.0-5 \|\| =8.20.0-5~bpo13+1 \|\| =8.20.0~rc1-1+exp1 \|\| =8.20.0~rc1-1+exp2 \|\| =8.20.0~rc1-1+exp3 \|\| =8.20.0~rc2-1 \|\| =8.20.0~rc2-1+exp1 \|\| =8.20.0~rc3-1 \|\| =8.20.0~rc3-1+exp1 \|\| =8.21.0-1 \|\| =8.21.0-1+exp1 \|\| =8.21.0-2 \|\| =8.21.0-2+exp1 \|\| =8.21.0~rc1-1+exp1 \|\| =8.21.0~rc2-1 \|\| =8.21.0~rc2-1+exp1 \|\| =8.21.0~rc3-1 \|\| =8.21.0~rc3-1+exp1	-
debian 14	curl	=8.14.1-2 \|\| =8.14.1-2+exp1 \|\| =8.15.0-1 \|\| =8.15.0-1~bpo13+1 \|\| =8.15.0-1~exp1 \|\| =8.15.0~rc1-1exp1 \|\| =8.15.0~rc2-1~exp1 \|\| =8.15.0~rc3-1~exp1 \|\| =8.16.0-1 \|\| =8.16.0-1+exp1 \|\| =8.16.0-1~bpo13+1 \|\| =8.16.0-2 \|\| =8.16.0-3 \|\| =8.16.0-4 \|\| =8.16.0-4~bpo13+1 \|\| =8.16.0~rc1-1~exp1 \|\| =8.16.0~rc2-1 \|\| =8.16.0~rc2-2 \|\| =8.16.0~rc3-1 \|\| =8.17.0-1 \|\| =8.17.0-2 \|\| =8.17.0-3 \|\| =8.17.0~rc1-1~exp1 \|\| =8.17.0~rc2-1 \|\| =8.17.0~rc3-1 \|\| =8.18.0-1 \|\| =8.18.0-1~bpo13+1 \|\| =8.18.0-2 \|\| =8.18.0~rc1-1+exp1 \|\| =8.18.0~rc2-1 \|\| =8.18.0~rc3-1 \|\| =8.19.0-1 \|\| =8.19.0-1+exp1 \|\| =8.19.0-1~bpo13+1 \|\| =8.19.0-2 \|\| =8.19.0-3 \|\| =8.19.0-3+exp1 \|\| =8.19.0-3+exp2 \|\| =8.19.0~rc1-1~exp1 \|\| =8.19.0~rc2-1 \|\| =8.19.0~rc2-2 \|\| =8.19.0~rc3-1 \|\| =8.20.0-1 \|\| =8.20.0-1+exp \|\| =8.20.0-2 \|\| =8.20.0-2+exp1 \|\| =8.20.0-2~bpo13+1 \|\| =8.20.0-3 \|\| =8.20.0-4 \|\| =8.20.0-5 \|\| =8.20.0-5~bpo13+1 \|\| =8.20.0~rc1-1+exp1 \|\| =8.20.0~rc1-1+exp2 \|\| =8.20.0~rc1-1+exp3 \|\| =8.20.0~rc2-1 \|\| =8.20.0~rc2-1+exp1 \|\| =8.20.0~rc3-1 \|\| =8.20.0~rc3-1+exp1 \|\| =8.21.0~rc1-1+exp1 \|\| >=0 <8.21.0~rc2-1	8.21.0~rc2-1
alpine v3.24	curl	>=8.8.0 <8.21.0-r0	8.21.0-r0

Aliases

1. CVE-2026-90792. NVD-2026-90793. OSV-DEBIAN-2026-90794. OSV-2026-90795. OSV-ALPINE-2026-90796. SECURITY-TRACKER-CVE-2026-90797. SECURITY-CVE-2026-9079

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.