Libcurl contained a flaw where, when instructed to clear proxy authentication credentials, it does not perform the clear operation, leaving the old credentials available for reuse in subsequent transfers that should not use the proxy. These stale credentials can be exploited to impersonate the original client or gain unauthorized access to upstream services.

The issue affects the libcurl library distributed as curl. No specific version numbers are listed in the CNA data, so any installation that invokes the proxy authentication clearing routine in libcurl and has not applied a fix may be vulnerable. Applications that embed libcurl and rely on proxy credentials are therefore exposed.

The high CVSS score signals severe potential impact, while the EPSS score of 1% indicates that exploitation is considered unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack requires control over the request flow to libcurl; a local attacker with access to the process or a remote attacker who can influence the application’s use of libcurl may trigger the reuse of stale credentials. Although the flaw does not permit arbitrary code execution, it can compromise the confidentiality of proxy credentials and enable unauthorized upstream service access.