It was discovered that cURL, an URL transfer library, if configured to
use a proxy server with the HTTPS protocol, by default could send to the
proxy the same HTTP headers it sends to the destination server, possibly
leaking sensitive information.