Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-03T06:13:31 curl: curl: Information disclosure via incorrect Digest authentication header reuse 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CWE-201

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.

A flaw was found in curl. When `libcurl` performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data.

This Moderate-severity flaw in `libcurl` can lead to information disclosure when an application reuses a `libcurl` handle for transfers to different HTTP origins while using Digest authentication. The vulnerability arises from `libcurl` incorrectly sending the authentication header intended for the initial origin to a subsequent, different origin. This could expose sensitive authentication data to an unintended recipient, potentially compromising user credentials or session information. The only observed impact from this flaw is an integrity impact. - libcurl only — the curl CLI is not affected - Requires an application to reuse an easy handle across different HTTP origins while Digest auth state is attached — a specific programming pattern - Credentials themselves are not leaked; only the authenticated state ("Authorization: ..." HTTP header) - Fixed in curl 8.21.0; affected range: 7.10.6 – 8.20.0 Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Correct usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse: ```c // req.A curl = curl_easy_init(); ... curl_easy_cleanup(curl); // req.B curl = curl_easy_init(); ... curl_easy_cleanup(curl); ``` Fixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0 Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:29017 curl-main-8.21.0-0.1.hum1 Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:34975 rust-main-1.96.1-1.hum1 Red Hat Enterprise Linux 10 Affected curl Red Hat Enterprise Linux 6 Out of support scope curl Red Hat Enterprise Linux 7 Out of support scope curl Red Hat Enterprise Linux 8 Affected curl Red Hat Enterprise Linux 9 Affected curl Red Hat OpenShift Container Platform 4 Fix deferred rhcos Red Hat OpenShift Dev Spaces Not affected devspaces/code-rhel9 Red Hat Trusted Profile Analyzer Not affected rhtpa/rhtpa-trustification-service-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-11856 https://nvd.nist.gov/vuln/detail/CVE-2026-11856 https://curl.se/docs/CVE-2026-11856.html https://curl.se/docs/CVE-2026-11856.json https://hackerone.com/reports/3793260