This set of vulnerabilities in cURL (CVE-2026-4873 and related CVEs) involves improper connection reuse and credential leakage across multiple protocols including HTTP, SMB, and proxy handling. Specifically, cURL incorrectly reused non-TLS connections in STARTTLS scenarios, HTTP Negotiate connections, and SMB connections, potentially exposing sensitive information. Additional issues include leaking proxy credentials during redirects, leaking cookies due to stale host handling, and leaking .netrc and Digest authentication credentials when reusing proxy connections or switching proxies. These vulnerabilities affect cURL versions prior to 8.20.0 and have been addressed in updated packages by vendors such as Red Hat and Ubuntu.

The vulnerabilities could allow remote attackers to obtain sensitive information such as credentials and cookies by exploiting improper connection reuse and credential handling in cURL. This may lead to unauthorized disclosure of authentication data and session information. There are no known exploits in the wild at this time. The impact is primarily confidentiality loss due to information leakage.

Fixes for these vulnerabilities are available and have been released by major Linux distributors. Users should update to cURL version 8.20.0 or later, or apply the relevant security updates provided by their operating system vendors (e.g., Red Hat Hardened Images RPMs update curl-8.20.0-0.1.hum1, Ubuntu security notices USN-8227-1). Standard system updates will apply these fixes. No additional mitigation actions are required beyond applying these updates.