CVE-2026-11856
Description
A flaw was found in curl. When libcurl performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data.
Statement
This Moderate-severity flaw in libcurl can lead to information disclosure when an application reuses a libcurl handle for transfers to different HTTP origins while using Digest authentication. The vulnerability arises from libcurl incorrectly sending the authentication header intended for the initial origin to a subsequent, different origin. This could expose sensitive authentication data to an unintended recipient, potentially compromising user credentials or session information. The only observed impact from this flaw is an integrity impact.
- libcurl only — the curl CLI is not affected
- Requires an application to reuse an easy handle across different HTTP origins while Digest auth state is attached — a specific programming pattern
- Credentials themselves are not leaked; only the authenticated state ("Authorization: ..." HTTP header)
- Fixed in curl 8.21.0; affected range: 7.10.6 – 8.20.0
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Correct usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:
c
// req.A
curl = curl_easy_init();
...
curl_easy_cleanup(curl);
// req.B
curl = curl_easy_init();
...
curl_easy_cleanup(curl);
Fixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
AC:H — exploitation requires application-level libcurl easy handle reuse across different HTTP origins with Digest authentication, a specific programming pattern
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
