# CVE-2026-3784 ## Summary - **CVE ID:** CVE-2026-3784 - **Severity:** MEDIUM - **CVSS Score:** 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) - **CWE:** CWE-305 - **Published:** Mar 11, 2026 - **Last Modified:** Sep 15, 2026 ## Description curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection. ## Affected Products - curl — curl (8.18.0) - curl — curl (8.17.0) - curl — curl (8.16.0) - curl — curl (8.15.0) - curl — curl (8.14.1) - curl — curl (8.14.0) - curl — curl (8.13.0) - curl — curl (8.12.1) - curl — curl (8.12.0) - curl — curl (8.11.1) - curl — curl (8.11.0) - curl — curl (8.10.1) - curl — curl (8.10.0) - curl — curl (8.9.1) - curl — curl (8.9.0) - curl — curl (8.8.0) - curl — curl (8.7.1) - curl — curl (8.7.0) - curl — curl (8.6.0) - curl — curl (8.5.0) - curl — curl (8.4.0) - curl — curl (8.3.0) - curl — curl (8.2.1) - curl — curl (8.2.0) - curl — curl (8.1.2) - curl — curl (8.1.1) - curl — curl (8.1.0) - curl — curl (8.0.1) - curl — curl (8.0.0) - curl — curl (7.88.1) - curl — curl (7.88.0) - curl — curl (7.87.0) - curl — curl (7.86.0) - curl — curl (7.85.0) - curl — curl (7.84.0) - curl — curl (7.83.1) - curl — curl (7.83.0) - curl — curl (7.82.0) - curl — curl (7.81.0) - curl — curl (7.80.0) - curl — curl (7.79.1) - curl — curl (7.79.0) - curl — curl (7.78.0) - curl — curl (7.77.0) - curl — curl (7.76.1) - curl — curl (7.76.0) - curl — curl (7.75.0) - curl — curl (7.74.0) - curl — curl (7.73.0) - curl — curl (7.72.0) - curl — curl (7.71.1) - curl — curl (7.71.0) - curl — curl (7.70.0) - curl — curl (7.69.1) - curl — curl (7.69.0) - curl — curl (7.68.0) - curl — curl (7.67.0) - curl — curl (7.66.0) - curl — curl (7.65.3) - curl — curl (7.65.2) - curl — curl (7.65.1) - curl — curl (7.65.0) - curl — curl (7.64.1) - curl — curl (7.64.0) - curl — curl (7.63.0) - curl — curl (7.62.0) - curl — curl (7.61.1) - curl — curl (7.61.0) - curl — curl (7.60.0) - curl — curl (7.59.0) - curl — curl (7.58.0) - curl — curl (7.57.0) - curl — curl (7.56.1) - curl — curl (7.56.0) - curl — curl (7.55.1) - curl — curl (7.55.0) - curl — curl (7.54.1) - curl — curl (7.54.0) - curl — curl (7.53.1) - curl — curl (7.53.0) - curl — curl (7.52.1) - curl — curl (7.52.0) - curl — curl (7.51.0) - curl — curl (7.50.3) - curl — curl (7.50.2) - curl — curl (7.50.1) - curl — curl (7.50.0) - curl — curl (7.49.1) - curl — curl (7.49.0) - curl — curl (7.48.0) - curl — curl (7.47.1) - curl — curl (7.47.0) - curl — curl (7.46.0) - curl — curl (7.45.0) - curl — curl (7.44.0) - curl — curl (7.43.0) - curl — curl (7.42.1) - curl — curl (7.42.0) - curl — curl (7.41.0) - curl — curl (7.40.0) - curl — curl (7.39.0) - curl — curl (7.38.0) - curl — curl (7.37.1) - curl — curl (7.37.0) - curl — curl (7.36.0) - curl — curl (7.35.0) - curl — curl (7.34.0) - curl — curl (7.33.0) - curl — curl (7.32.0) - curl — curl (7.31.0) - curl — curl (7.30.0) - curl — curl (7.29.0) - curl — curl (7.28.1) - curl — curl (7.28.0) - curl — curl (7.27.0) - curl — curl (7.26.0) - curl — curl (7.25.0) - curl — curl (7.24.0) - curl — curl (7.23.1) - curl — curl (7.23.0) - curl — curl (7.22.0) - curl — curl (7.21.7) - curl — curl (7.21.6) - curl — curl (7.21.5) - curl — curl (7.21.4) - curl — curl (7.21.3) - curl — curl (7.21.2) - curl — curl (7.21.1) - curl — curl (7.21.0) - curl — curl (7.20.1) - curl — curl (7.20.0) - curl — curl (7.19.7) - curl — curl (7.19.6) - curl — curl (7.19.5) - curl — curl (7.19.4) - curl — curl (7.19.3) - curl — curl (7.19.2) - curl — curl (7.19.1) - curl — curl (7.19.0) - curl — curl (7.18.2) - curl — curl (7.18.1) - curl — curl (7.18.0) - curl — curl (7.17.1) - curl — curl (7.17.0) - curl — curl (7.16.4) - curl — curl (7.16.3) - curl — curl (7.16.2) - curl — curl (7.16.1) - curl — curl (7.16.0) - curl — curl (7.15.5) - curl — curl (7.15.4) - curl — curl (7.15.3) - curl — curl (7.15.2) - curl — curl (7.15.1) - curl — curl (7.15.0) - curl — curl (7.14.1) - curl — curl (7.14.0) - curl — curl (7.13.2) - curl — curl (7.13.1) - curl — curl (7.13.0) - curl — curl (7.12.3) - curl — curl (7.12.2) - curl — curl (7.12.1) - curl — curl (7.12.0) - curl — curl (7.11.2) - curl — curl (7.11.1) - curl — curl (7.11.0) - curl — curl (7.10.8) - curl — curl (7.10.7) - curl — curl (7.10.6) - curl — curl (7.10.5) - curl — curl (7.10.4) - curl — curl (7.10.3) - curl — curl (7.10.2) - curl — curl (7.10.1) - curl — curl (7.10) - curl — curl (7.9.8) - curl — curl (7.9.7) - curl — curl (7.9.6) - curl — curl (7.9.5) - curl — curl (7.9.4) - curl — curl (7.9.3) - curl — curl (7.9.2) - curl — curl (7.9.1) - curl — curl (7.9) - curl — curl (7.8.1) - curl — curl (7.8) - curl — curl (7.7.3) - curl — curl (7.7.2) - curl — curl (7.7.1) - curl — curl (7.7) - curl — curl (7.7.0) - curl — curl (a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4) ## References - [CNA](https://curl.se/docs/CVE-2026-3784.json) - [CNA](https://curl.se/docs/CVE-2026-3784.html) - [CNA](https://hackerone.com/reports/3584903) - [CVE](http://www.openwall.com/lists/oss-security/2026/03/11/3) - [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-253495.html) ## Exploitation Prediction (EPSS) - **EPSS Score:** 0.41% - **EPSS Percentile:** 35.0 --- _Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._