CVE-2026-7168

Successfully using libcurl to do a transfer over a specific HTTP proxy (proxyA) with Digest authentication and then changing the proxy host to a second one (proxyB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Proxy-Authorization: header field meant for proxyA, to proxyB.

• curl 8.20.0-1 [trixie] - curl 8.14.1-2+deb13u4 [bookworm] - curl 7.88.1-10+deb12u15 [bullseye] - curl (Minor issue; can be fixed in next update) https://curl.se/docs/CVE-2026-7168.html Introduced by: https://github.com/curl/curl/commit/fc6eff13b5414caf6edf22d73a3239e074a04216 (curl-7_12_0) Fixed by: https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 (curl-8_20_0)