ALPINE-CVE-2026-9079

Source
https://security.alpinelinux.org/vuln/CVE-2026-9079
Import Source
https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-9079.json
JSON Data
https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-9079
Upstream
  • CVE-2026-9079
Published
2026-07-03T07:16:25.620Z
Modified
2026-07-07T10:30:04.631866963Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

References

Affected packages

Alpine:v3.24 / curl

Package

Name
curl
Purl
pkg:apk/alpine/curl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.21.0-r0

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-9079.json"