libcurl fails to reset the proxy authentication state when a single handle is reused for sequential transfers that use environment‑driven proxy settings. When the first connection authenticates with proxyA using Digest authentication, the same handle is reused for a request that is forwarded through proxyB. Instead of clearing the stale state, libcurl mistakenly sends the Proxy‑Authorization header that belongs to proxyA to proxyB. The header carries the credential information for proxyA, which can be captured by any observer of the traffic to proxyB. This leak allows an attacker who can see or control the second proxy connection to obtain the credentials that were meant only for the first proxy.

This issue affects any use of the curl:curl product’s libcurl library when a handle is reused for multiple HTTP(S) requests that are directed through different proxies via environment variables. Without a specified affected version, any libcurl release that implements handle‑reuse logic could be vulnerable, especially applications that perform high‑frequency requests or route traffic through multiple proxies within a single session.

The CVSS score of 9.1 classifies the flaw as high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low current likelihood of exploitation. The vulnerability does not require elevated privileges or code execution on the target system; however, it is likely exploitable by an attacker who can observe or influence traffic to the second proxy. It is inferred that the attacker needs access to network traffic between the victim and the second proxy to capture the leaked Proxy-Authorization header.