CVE-2026-7168 Analysis for VIP Enterprise Gateway

Products

VIP Service

Issue/Introduction

A medium-severity vulnerability has been identified in libcurl (versions 7.12.0 through 8.19.0), tracked as CVE-2026-7168 and known as the "cross-proxy Digest auth state leak." Because VIP Enterprise Gateway utilizes libcurl for certain network operations, this article provides a formal vulnerability analysis and impact assessment for customers running EG versions 9.11.1 and 9.11.2.

Vulnerability Description

The flaw resides in how libcurl manages HTTP proxy authentication states when a single transfer handle is reused across multiple sequential transfers.

The vulnerability is triggered under the following specific lifecycle:

An application uses a single libcurl handle to make a request through a specific HTTP proxy (Proxy A) using Digest authentication.
Following a successful authentication negotiation, libcurl caches the computed Proxy-Authorization header on that handle.
The application subsequently changes the target proxy to a different proxy (Proxy B) via CURLOPT_PROXY but reuses the exact same handle for the next transfer.
libcurl incorrectly leaks the cached Proxy-Authorization header meant for Proxy A to Proxy B.

Security Risk: If Proxy B is malicious or compromised, it can capture the leaked Proxy-Authorization header and use it to impersonate the client, leading to authentication bypass or capture-replay attacks against Proxy A.

Exploitation Criteria

For a system to be vulnerable, all of the following conditions must be met:

Criteria 1: The application must use the libcurl handle to route requests through an HTTP proxy.
Criteria 2: The proxy request must explicitly utilize Digest Authentication.
Criteria 3: The application must reuse the exact same libcurl handle across transfers involving different proxies.

Environment

Product: VIP Enterprise Gateway (EG)

Version Affected: 9.11.1, 9.11.2

Resolution

Impact Analysis for VIP Enterprise Gateway

While VIP Enterprise Gateway 9.11.1 and 9.11.2 ship with libcurl 8.10.1 (which falls within the theoretically affected version range), Broadcom engineering has evaluated the software architecture against the required exploitation criteria:

Exploitation Criteria	Evaluation Status	EG Context & Mitigation
1. Use of HTTP Proxies	MET	EG can be configured to use HTTP proxies for outbound traffic.
2. Use of Digest Authentication	NOT MET	EG does not utilize or support Digest Authentication for proxy connections.
3. Reuse of Handles Across Different Proxies	NOT MET	EG's internal network logic does not reuse active `libcurl` handles across dynamically changing proxy endpoints.

Conclusion: Because multiple critical criteria are Not Met, CVE-2026-7168 does not pose a functional security risk to VIP Enterprise Gateway 9.11.1 or 9.11.2 in standard deployment configurations. libcurl version will be upgraded to 8.20.1 in 9.11.3 version of VIP Enterprise gateway which is slated tentatively for End of July release,