CVE-2026-11856
published 2026-07-03CVE-2026-11856: Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one…
PriorityP358critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.69%
51.0th percentile
Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Authorization:` header field meant for `hostA`,
to `hostB`.
Affected
179 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
| curl | curl | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP requests where an Authorization header using Digest authentication scheme is sent to a different host/origin than the one for which it was originally issued — indicative of libcurl handle reuse leaking auth state across origins. ↗
- →Only libcurl-based applications are affected (not the curl CLI). Focus detection and auditing on applications that use libcurl's easy handle API and reuse handles across different HTTP origins with Digest authentication. ↗
- →Flag application code patterns where a single libcurl easy handle is reused for transfers to different HTTP origins while Digest auth state may be attached, without calling curl_easy_cleanup() and curl_easy_init() between requests. ↗
- ·Vulnerability only affects libcurl versions 7.10.6 through 8.20.0 inclusive; fixed in 8.21.0. Audit deployed libcurl versions to scope exposure. ↗
- ·The curl CLI tool is NOT affected; only applications using the libcurl C library API are vulnerable. Detections should be scoped accordingly. ↗
- ·The flaw leaks the Authorization HTTP header (Digest auth state) to an unintended origin — credentials themselves are not directly leaked, but the authenticated session header is. ↗
- ·Red Hat has deferred fixes for RHEL 6, 7, 8, 9, 10 and RHCOS/OpenShift 4. Red Hat Hardened Images remain affected. No mitigation is currently available from Red Hat; the recommended workaround is to create a fresh handle per origin. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
curl vulnerability
vendor_ubuntu·2026-08-19
CVE-2026-11856 curl vulnerability
Title: curl vulnerability
Summary: curl could be made to expose sensitive information over the network.
It was discovered that curl incorrectly handled reusing connections
when the origin changed between transfers. A remote attacker could
possibly use this issue to obtain sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
curl: curl: Information disclosure via incorrect Digest authentication header reuse
vendor_redhat·2026-07-03·CVSS 9.8
CVE-2026-11856 [CRITICAL] CWE-201 curl: curl: Information disclosure via incorrect Digest authentication header reuse
curl: curl: Information disclosure via incorrect Digest authentication header reuse
Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Authorization:` header field meant for `hostA`,
to `hostB`.
A flaw was found in curl. When `libcurl` performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized
GHSA
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing
ghsa_unreviewed·2026-07-03
CVE-2026-11856 Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing
Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Authorization:` header field meant for `hostA`,
to `hostB`.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-11856 mingw-curl: curl: Information disclosure via incorrect Digest authentication header reuse [fedora-all]
bugzilla·2026-07-08·CVSS 9.8
CVE-2026-11856 [CRITICAL] CVE-2026-11856 mingw-curl: curl: Information disclosure via incorrect Digest authentication header reuse [fedora-all]
CVE-2026-11856 mingw-curl: curl: Information disclosure via incorrect Digest authentication header reuse [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Authorization:` header field meant for `hostA`,
to `hostB`.
Bugzilla
CVE-2026-11856 curl: curl: Information disclosure via incorrect Digest authentication header reuse [fedora-all]
bugzilla·2026-07-08·CVSS 9.8
CVE-2026-11856 [CRITICAL] CVE-2026-11856 curl: curl: Information disclosure via incorrect Digest authentication header reuse [fedora-all]
CVE-2026-11856 curl: curl: Information disclosure via incorrect Digest authentication header reuse [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Authorization:` header field meant for `hostA`,
to `hostB`.
Bugzilla
CVE-2026-11856 curl: curl: Information disclosure via incorrect Digest authentication header reuse
bugzilla·2026-07-03·CVSS 9.8
CVE-2026-11856 [CRITICAL] CVE-2026-11856 curl: curl: Information disclosure via incorrect Digest authentication header reuse
CVE-2026-11856 curl: curl: Information disclosure via incorrect Digest authentication header reuse
Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Authorization:` header field meant for `hostA`,
to `hostB`.
2026-07-03
Published