These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
libcurl fails to clear proxy authentication state between requests when reusing a handle for sequential transfers driven by environment-variable proxy configuration. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`. This issue can lead to uni [truncated]
libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. A logical error in the code could cause a request issued by an application to wrongfully reuse an existing connection to the same server that was authenticated using different services. This issue is particularly relevant for users of Negotiate authentication. The CVE record indica [truncated]
CVE-2026-12064 is a high-severity vulnerability in Curl, a popular command-line tool for transferring data. The vulnerability occurs when a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), leading to a disconnect between the tool layer and libcurl. This causes the tool layer to incorrectly infer the URL scheme, bypassing critical SSH security options. The vulnerabili [truncated]
CVE-2023-38546 is a low-severity libcurl issue where a duplicated easy handle can inherit cookie-enabled state without the underlying cookie file source being preserved correctly. Under the specific conditions described by the vendor and NVD, a program may later try to load cookies from a local file named "none" in its current working directory. The main risk is unintended cookie injection into an applica [truncated]