Two curl bugs in Apple’s updates: redirects, proxies and credential mix-ups

A network library has to remember more than where to send bytes. It also has to keep each credential attached to the right destination and identity. Two upstream curl fixes included in Apple’s July updates show how that association can go wrong without a buffer overflow.

Why these curl CVEs appear in an Apple advisory

Apple’s iOS and iPadOS 26.6 advisory lists CVE-2026-3783 and CVE-2026-3784 under curl and identifies the possibility of credentials reaching a different origin. It explicitly notes the third-party origin of the CVE assignments. The update was released July 27. Consult the advisory for the supported devices and platform scope.

Apple’s iOS and iPadOS 26.6 security advisory

The upstream notices give the two issues distinct mechanisms: bearer-token handling after a redirect, and reuse of a proxy connection authenticated with different credentials. Reading them separately makes it clearer what each correction addresses.

CVE-2026-3783: a redirect changes the destination

curl describes a case where an OAuth2 bearer token used for one HTTP transfer could be carried to another hostname after a redirect when netrc-based credential handling was also involved. The error concerned the interaction of credential sources and redirect processing. It was not a failure of TLS encryption or evidence that all ordinary redirects disclose credentials.

curl’s CVE-2026-3783 advisory

A bearer token grants access to whoever presents it to a service that accepts it. The library needs to keep the token associated with the destination it was supplied for. A hostname change can require another credential decision even when the application sees the transfer as one continuous download.

An application can configure libcurl to consult netrc for login information. Those credentials are a separate source from an OAuth2 bearer token. Their presence should not change the scope of an unrelated token as a transfer follows redirects.

libcurl’s documentation for netrc credential handling

CVE-2026-3784: a reused connection keeps the wrong identity

The second notice concerns an HTTP proxy connection reused for a later request carrying different proxy credentials. Connection reuse must preserve the requested authentication identity. If the existing connection cannot do that, the library needs a suitable different connection.

curl’s CVE-2026-3784 advisory

This is a problem with the identity associated with cached connection state. Review which properties make a connection safe to reuse, including authentication context. That matters particularly in software serving multiple accounts or changing proxy configuration during its lifetime.

The advisories do not establish exposure of any particular organization’s tokens. If you see suspicious credential use, examine the actual application, configuration, destination records and token activity. Keep secret values out of logs. An affected version establishes potential exposure; misuse requires additional evidence.

Find the copy of curl the application really uses

Both upstream advisories identify curl 8.19.0 as a fixed release and also document maintenance backports. A smaller version number can therefore require more context than a simple comparison with 8.19.0. Distribution and operating-system vendors may ship a corrected build according to their own servicing records.

Apple’s update covers its bundled component. A separately installed curl, container image or application-bundled libcurl has another update owner. Replacing one executable does not verify every copy. Identify the application and dependency source before selecting the vendor’s remediation guidance.

Use non-production tokens and endpoints you control for routine checks of destination changes and account separation. Confirm that logs redact credentials and expected transfers still work. Record the corrected build and the application path tested so the result can be tied to the software the business actually uses.

Source check: September 8, 2026. The underlying findings are upstream curl disclosures incorporated into Apple’s software-security advisories. This article does not claim that Short Circuit LLC discovered them or that the bugs originated in Apple-only code.