CVE-2026-3784: Haxx Curl Auth Bypass Vulnerability

CVE-2026-3784 Overview

CVE-2026-3784 is an authentication bypass vulnerability in curl where the application incorrectly reuses an existing HTTP proxy connection performing a CONNECT operation to a server, even when a new request specifies different credentials for the HTTP proxy. This improper connection reuse behavior violates the expected security model where separate credentials should establish separate connections.

Critical Impact

Attackers may be able to leverage improperly reused proxy connections to access resources using another user's authenticated session, potentially leading to unauthorized data access or credential exposure.

Affected Products

• haxx curl (all affected versions)

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-3784 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3784

Vulnerability Analysis

This vulnerability relates to CWE-305 (Authentication Bypass by Primary Weakness), manifesting in curl's HTTP proxy connection handling logic. When curl establishes a connection to a server through an HTTP proxy using the CONNECT method, it creates a tunnel through which subsequent requests are sent. The vulnerability occurs because curl fails to properly validate whether the credentials associated with a new request match those of an existing proxy connection before reusing that connection.

The improper connection reuse means that if a user or application makes multiple requests through the same proxy using different sets of credentials, curl may incorrectly route requests through a connection authenticated with different credentials than those specified. This breaks the security isolation that should exist between requests using different authentication contexts.

Root Cause

The root cause lies in curl's connection pooling and reuse logic for HTTP proxy connections. When determining whether to reuse an existing CONNECT tunnel, curl does not adequately verify that the proxy credentials match between the new request and the established connection. The proper behavior requires curl to either create a new connection or select only connections that match all relevant authentication parameters.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker who can influence the sequence of proxy-authenticated requests (for example, in a multi-user environment or shared application) could potentially exploit this behavior to have their requests sent over a connection authenticated with another user's credentials, or vice versa.

The vulnerability manifests in the HTTP proxy connection handling logic where CONNECT tunnels are reused without proper credential verification. When a client application using curl sends requests through an HTTP proxy with varying credentials, the connection pooling mechanism may select an inappropriate existing connection rather than establishing a new authenticated session. For detailed technical analysis, refer to the HackerOne Report #3584903 and the official cURL security advisory.

Detection Methods for CVE-2026-3784

Indicators of Compromise

• Unexpected proxy authentication events in proxy server logs where credentials appear inconsistent with the requesting user or application
• Multiple requests from a single source appearing to use different credential sets through the same persistent connection
• Anomalous access patterns where users access resources they should not have authorization for

Detection Strategies

• Monitor HTTP proxy logs for connection reuse patterns that span multiple authentication contexts
• Implement network traffic analysis to identify CONNECT tunnels being used with mismatched credential sessions
• Deploy application-level logging to track curl library usage and proxy connection behavior

Monitoring Recommendations

• Enable verbose logging in applications using curl for proxy connections to capture credential handling
• Configure proxy servers to log connection establishment and authentication events with sufficient detail
• Implement alerting for unusual proxy authentication patterns or credential usage anomalies

How to Mitigate CVE-2026-3784

Immediate Actions Required

• Update curl to the latest patched version as soon as available from the vendor
• Review applications using curl with HTTP proxy CONNECT functionality for potential exposure
• Consider disabling proxy connection reuse temporarily using --no-keepalive or equivalent programmatic options
• Audit systems where multiple credential contexts may share curl instances

Patch Information

Haxx has released security information regarding this vulnerability. Organizations should consult the official cURL CVE-2026-3784 advisory for patch details and affected version information. The OpenWall security discussion provides additional community analysis and mitigation guidance.

Workarounds

• Disable HTTP proxy connection pooling by configuring curl to use fresh connections for each request with different credentials
• Implement application-level credential isolation ensuring separate curl handles for different authentication contexts
• Use the CURLOPT_FRESH_CONNECT option to force new connections when proxy credentials change

# Configuration example - Force fresh connections in curl CLI
curl --no-keepalive --proxy-user user:pass --proxy http://proxy:8080 https://target.example.com

# In code, set CURLOPT_FRESH_CONNECT to prevent connection reuse
# curl_easy_setopt(curl, CURLOPT_FRESH_CONNECT, 1L);