A vulnerability (CVE-2026-6253) in curl and libcurl affects Red Hat Hardened Images RPMs where proxy credentials can be leaked during HTTP redirects if curl is configured to use different proxies for different URL schemes, with the first proxy requiring authentication and the second not. This improper credential management (CWE-522) can expose sensitive proxy credentials to an attacker intercepting traffic. Red Hat has released updated RPMs (curl-8.20.0-0.1.hum1 and related packages) for aarch64 and x86_64 architectures as part of a bug fix and enhancement update. The vendor rates the severity as moderate and assigns a CVSS v3 base score of 5.3, indicating a medium impact. The advisory recommends avoiding proxy configurations that require credentials to mitigate the issue. No known exploits in the wild are reported.

The vulnerability can lead to unauthorized disclosure of proxy authentication credentials during redirects, potentially allowing attackers to gain access to sensitive information or unauthorized proxy access. The impact is limited to scenarios where curl is configured with distinct proxies for different URL schemes and the first proxy requires authentication while the redirected proxy does not. There is no reported impact on integrity or availability.

Red Hat has released updated RPM packages including curl-8.20.0-0.1.hum1 and related libraries to address this vulnerability. Users should apply these updates as provided by Red Hat. Additionally, to mitigate the issue, avoid configuring curl or libcurl to use proxies that require authentication credentials in a manner that could cause credential leakage during redirects. Follow Red Hat's official update instructions at https://images.redhat.com/. No other specific mitigations are indicated by the vendor.