The flaw in curl causes the program to inadvertently forward authentication credentials intended for the target server to an HTTP proxy. When the proxy returns an HTTP 401 Unauthorized status instead of a proper 407 Proxy Authentication Required challenge during a tunnel setup, curl misinterprets the response and transmits the origin server’s credentials. The result is that an attacker controlling or compromising a proxy can obtain sensitive passwords and authentication tokens. This vulnerability specifically reflects a credential disclosure weakness, as catalogued by CWE-201.

All systems that use the curl utility and rely on proxy routing are potentially impacted, regardless of operating system. The exact affected versions are not specified in the public advisory, so any installation of curl that has not been updated to a release containing the fix could be vulnerable.

The CVSS score of 6.5 indicates moderate severity, and no EPSS score is available to gauge current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation as of the latest data. An attacker would need to control or compromise a proxy that the client is configured to use; the attack is feasible if a proxy server misbehaves or is malicious. Once the proxy is capable of sending an HTTP 401 response, credentials for the destination host can be captured, leading to information disclosure. The primary vector is an untrusted or compromised HTTP proxy used by curl client instances.