CVE-2026-8927: env-set cross-proxy Digest auth state leak

AI-assisted preparation note

I used AI assistance to help structure and format this report, but the technical findings, PoC, and verification results are based on local testing against curl/libcurl 8.20.0.

Summary

I found a possible incomplete-fix variant of CVE-2026-7168 in libcurl 8.20.0.

The original issue involved stale Digest proxy authentication state being sent from proxyA to proxyB when the same libcurl easy handle was reused after changing proxies. In curl 8.20.0, the explicit CURLOPT_PROXY path appears to be fixed: changing the proxy via CURLOPT_PROXY clears the old proxy Digest/auth state correctly.