Is DLP vulnerable to CVE-2026-9079

Products

• Data Loss Prevention Core Package

Issue/Introduction

When instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them." When an application sets proxy credentials on a libcurl easy handle and then instructs libcurl to clear them, libcurl fails to actually erase the stored credentials. The stale credentials are then silently reused in subsequent transfers, potentially leaking them to unintended proxy endpoints. Does not affect the curl command-line tool.

Resolution

Proxy authentication credentials are never set on the curl handle. The stale-credential-clear failure path is unreachable because there are no credentials to clear. Contextual severity: NVD Critical (9.8) assumes proxy credentials in active use; effective exposure here is zero.