Description
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.
References (3)
Core 3
Core References
Scores
CVSS v3
9.8
EPSS
0.0106
EPSS Percentile
60.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-294
Status
published
Products (50)
curl/curl
7.10.6
curl/curl
7.10.7
curl/curl
7.10.8
curl/curl
7.11.0
curl/curl
7.11.1
curl/curl
7.11.2
curl/curl
7.12.0
curl/curl
7.12.1
curl/curl
7.12.2
curl/curl
7.12.3
... and 40 more
Published
Jul 03, 2026
Tracked Since
Jul 03, 2026