| Package | Affected versions | Patched versions |
|---|---|---|
| curl | ≥ 7.12.0, < 8.21.0 | 8.21.0 |
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free