CVE-2015-3236: cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connec...

Security readout for executives and security teams

This flaw could cause curl or libcurl to send HTTP Basic credentials from an earlier request when an application reused a reset connection handle for the same hostname. The business risk is unintended credential disclosure to a remote endpoint. The provided sources do not show active exploitation. Exposure is most likely in applications, appliances, scripts, or vendor products bundling curl/libcurl 7.40.0 through 7.42.1 and using HTTP Basic authentication with reused easy handles. Treat as a credential exposure risk requiring targeted remediation, not an emergency mass incident based on the provided evidence. Prioritize internet-facing or third-party-integrating systems using Basic authentication and affected libcurl versions. Mitigation focus: Upgrade curl/libcurl outside the affected 7.40.0 through 7.42.1 range using vendor-supported packages.; Check the curl advisory and OS/vendor advisories for backported fixes.; Prioritize systems that use HTTP Basic authentication through libcurl..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.