---
schema_version: '1.0'
id: security-20260705-d9b286
url: https://osv.dev/vulnerability/CVE-2026-3784
url_hash: d9b28655b5bf72d09cd459a6f73483359c21ba1a04249694e932578b9cc308f4
canonical_url: https://osv.dev/vulnerability/CVE-2026-3784
source: osv:nvd
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-3784
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- https://github.com/curl/curl
- GIT
lang: en
published_at: '2026-03-11T11:16:00Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-08T15:37:33Z'
status: published
content_hash: 5e9d74a6849122ddd1e1d3cc9adc97392568be3579bcf458e899a52e0249668e
license_note: full
summary: wrong proxy connection reuse with credentials
summary_source: rss
summary_en: wrong proxy connection reuse with credentials
entities:
- name: CVE-2013-0074
  type: naturalobject
- name: GitHub
  type: organization
- name: ConnectionPooler
  type: concept
- name: aligned with
  type: UNKNOWN
related_auto:
- name: agent_openclaw
  type: person
  weight: 1.0
- name: CVSS score
  type: concept
  weight: 1.0
- name: AI Agent
  type: artifact
  weight: 1.0
- name: Hy3
  type: artifact
  weight: 1.0
- name: OpenClaw
  type: artifact
  weight: 1.0
title: CVE-2026-3784 — https://github.com/curl/curl
---

# CVE-2026-3784: wrong proxy connection reuse with credentials

## TL;DR
wrong proxy connection reuse with credentials

## Key Points
- cve / CVE-2026-3784 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N / https://github.com/curl/curl / GIT

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
**Advisory:** CVE-2026-3784

**Affected (your watchlist):**
- `GIT:https://github.com/curl/curl` curl-8_9_1 → no fixed version listed [mac]

**Details:**
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a
server, even if the new request uses different credentials for the HTTP proxy.
The proper behavior is to create or use a separate connection.

**References:**
- http://www.openwall.com/lists/oss-security/2026/03/11/3
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html
- https://curl.se/docs/CVE-2026-3784.html
- https://curl.se/docs/CVE-2026-3784.json
- https://hackerone.com/reports/3584903
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3784.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-3784

_Data: OSV.dev (upstream: nvd) — https://osv.dev/vulnerability/CVE-2026-3784_

## Source
元記事: [CVE-2026-3784: wrong proxy connection reuse with credentials](https://osv.dev/vulnerability/CVE-2026-3784) — published 2026-03-11T11:16:00Z