---
schema_version: '1.0'
id: security-20260705-72d76e
url: https://osv.dev/vulnerability/CURL-CVE-2026-6253
url_hash: 72d76ebf800b556bd8ef9a72c443f7b3d5d51d2be347ecfc8598650c30383d45
canonical_url: https://osv.dev/vulnerability/CURL-CVE-2026-6253
source: osv:osv
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-6253
- CURL-CVE-2026-6253
- severity:Medium
- https://github.com/curl/curl
- GIT
lang: en
published_at: '2026-04-29T08:00:00Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-05T15:37:46Z'
status: published
content_hash: 453a710f3e88bb6451fdc10b197d941632993a3da5bc8d75c07c3f5b908c19d7
license_note: full
summary: proxy credentials leak over redirect-to proxy
summary_source: rss
summary_en: proxy credentials leak over redirect-to proxy
entities:
- name: GitHub
  type: organization
- name: earlyappleleaks
  type: person
- name: Overcrowded Bus
  type: artifact
key_facts: []
related: []
related_auto:
- name: Anonymous
  type: organization
  weight: 1.0
- name: AirPods
  type: artifact
  weight: 1.0
- name: Claude Code
  type: artifact
  weight: 1.0
- name: セッション漏洩
  type: event
  weight: 1.0
- name: local-llm
  type: content
  weight: 1.0
title: 'CVE-2026-6253: proxy credentials leak over redirect-to proxy'
---

# CVE-2026-6253: proxy credentials leak over redirect-to proxy

## TL;DR
proxy credentials leak over redirect-to proxy

## Key Points
- cve / CVE-2026-6253 / CURL-CVE-2026-6253 / severity:Medium / https://github.com/curl/curl / GIT

## Details
**Severity:** Medium
**Advisory:** CURL-CVE-2026-6253 (CVE-2026-6253)

**Affected (your watchlist):**
- `GIT:https://github.com/curl/curl` curl-8_9_1 → no fixed version listed [mac]

**Details:**
curl might erroneously pass on credentials for a first proxy to a second
proxy.

This can happen when the following conditions are true:

1. curl is setup to use specific different proxies for different URL schemes
2. the first proxy needs credentials
3. the second proxy uses no credentials
4. while using the first proxy (using say `http://`), curl is asked to follow
   a redirect to a URL using another scheme (say `https://`), accessed using a
   second, different, proxy

_Data: OSV.dev (upstream: osv) — https://osv.dev/vulnerability/CURL-CVE-2026-6253_

## Source
元記事: [CVE-2026-6253: proxy credentials leak over redirect-to proxy](https://osv.dev/vulnerability/CURL-CVE-2026-6253) — published 2026-04-29T08:00:00Z