contrary to expectations and documentation. A subsequent transfer on the same
handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL
isset next, leaking state information.
Metrics
Affected Vendors & Products
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Curl
Subscribe
|
Curl
Subscribe
|
| Source | ID | Title |
|---|---|---|
 Ubuntu USN |
USN-8927-1 | curl vulnerabilities |
| Ubuntu USN |
USN-8932-1 | curl vulnerabilities |
| Ubuntu USN |
USN-8927-2 | curl vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Tue, 20 Oct 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 (AWS SigV4) authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled server using the same handle, curl unintentionally transmits the signed authorization header. This flaw allows a remote attacker to obtain access key identifiers and request signatures, leading to information disclosure. | Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information. |
| Title | curl: curl: stale SigV4 headers sent unintended | stale SigV4 headers sent unintended |
| References |
|
Sun, 18 Oct 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Curl
Curl curl |
|
| Vendors & Products |
Curl
Curl curl |
Sat, 17 Oct 2026 00:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 (AWS SigV4) authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled server using the same handle, curl unintentionally transmits the signed authorization header. This flaw allows a remote attacker to obtain access key identifiers and request signatures, leading to information disclosure. | |
| Title | curl: curl: stale SigV4 headers sent unintended | |
| Weaknesses | CWE-201 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: curl
Published:
Updated: 2026-10-20T19:57:01.794Z
Reserved: 2026-09-07T12:11:44.926Z
Link: CVE-2026-86409
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-20T20:17:25.223
Modified: 2026-10-20T20:17:25.223
Link: CVE-2026-86409
Redhat
OpenCVE Enrichment
Updated: 2026-10-18T14:15:14Z