The flaw occurs when a libcurl handle is reused for multiple sequential transfers directed by environment‑variable proxy settings. The library fails to reset the proxy authentication state between requests, so if the first transfer authenticates to proxyA using Digest authentication, the following request sent via proxyB will carry the Proxy-Authorization header meant for proxyA, leaking proxy credentials to anyone monitoring traffic to proxyB. This constitutes an information disclosure and reflects improper state handling, mapped to CWE‑201.

This issue affects any use of the curl:curl product’s libcurl library when a handle is reused for multiple HTTP(S) requests that are directed through different proxies via environment variables. Without a specified affected version, any libcurl release that implements handle‑reuse logic could be vulnerable, especially applications that perform high‑frequency requests or route traffic through multiple proxies within a single session.

The CVSS score of 9.1 classifies the flaw as high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low current likelihood of exploitation. The vulnerability does not require elevated privileges or code execution on the target system; however, it is likely exploitable by an attacker who can observe or influence traffic to the second proxy. It is inferred that the attacker needs access to network traffic between the victim and the second proxy to capture the leaked Proxy‑Authorization header.