Skip to main content

libcurl CVE-2026-11856

| EUVDEUVD-2026-41501 CRITICAL
Authentication Bypass by Capture-replay (CWE-294)
2026-06-24 GHSA-9crq-qh8v-6xmm
Information Disclosure Curl Haxx
Critical
Disputed · 9.8 Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify app reusing curl handle
  2. Delivery
    Induce second transfer to attacker origin hostB
  3. Exploit
    libcurl reattaches hostA Digest header
  4. Execution
    Capture leaked Authorization credentials
  5. Impact
    Replay credentials against hostA

Vulnerability Assessment

Weakness
CWE
CWE-294
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Replay attack prevention
Exploitation Conditions

Exploitation requires an application built on libcurl to (1) perform an HTTP transfer to origin hostA using Digest authentication, (2) reuse the same libcurl easy handle without resetting auth state, and (3) issue a second transfer whose origin is changed to hostB, where hostB is attacker-controlled or attacker-influenced (e.g., via a dynamic or user-controlled URL or redirect). The credential leak only affects Digest authentication - not deployments using no auth or other auth schemes - and does not occur if the application uses a fresh or reset handle per origin; these are the key limiting factors that keep this from being a default-configuration remote compromise despite the AV:N vector.
Impact

The published CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk and is inconsistent with the described behavior: this is a confidentiality-only credential leak, so the Integrity:H and Availability:H metrics are not supported by the description, and AC:L ignores the required precondition that an application reuse the same handle across two different origins with Digest auth on the first. Corroborating signals point to lower priority: EPSS is only 0.25% (16th percentile), there is no CISA KEV listing, and no public exploit code is evident (the HackerOne report #3793260 is the researcher submission, not a released PoC). The Information Disclosure tag matches the actual impact. Net assessment: a genuine but conditional credential-disclosure bug (curl historically rates this class of issue Low), not a wormable RCE - treat the 9.8 as an automated or erroneous scoring artifact and prioritize based on whether your applications actually reuse handles across origins with Digest auth.
Exploit ScenarioDerived

An application uses one reused libcurl handle to first authenticate to a trusted service (hostA) with Digest credentials, then makes a second request to a different host (hostB) that an attacker controls or can influence (e.g., via a user-supplied URL, redirect, or SSRF-style flow). libcurl attaches hostA's 'Authorization:' header to the hostB request, handing the attacker the Digest credential material. No public PoC is currently identified, and the network attack vector still requires the specific handle-reuse-then-origin-change sequence to occur.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 06, 2026

Cross-origin credential leakage in libcurl (curl 7.10.6 through 8.20.0) causes the HTTP Digest 'Authorization:' header computed for one origin (hostA) to be wrongly reused on a subsequent transfer to a different origin (hostB) when an application reuses the same easy handle. This exposes Digest authentication credentials to an unintended, potentially attacker-controlled host, and is tracked as an Information Disclosure issue (EUVD-2026-41501). No public exploit identified at time of analysis; EPSS is low at 0.25% (16th percentile) and it is not in CISA KEV, so this is a latent credential-exposure bug rather than a demonstrated mass-exploitation threat.

Earlier versions of this analysis (2)
v2 Jul 06, 2026 - 19:34 cvss changed CVSS 9.8

Credential leakage in libcurl (versions through 8.18.0/8.20.0) causes the HTTP Digest Authorization: header computed for one origin (hostA) to be wrongly reused on a second transfer to a different origin (hostB) when the same easy handle is reused. This exposes Digest authentication material to an unintended host, enabling a malicious or unrelated server to capture credentials meant for another. No public exploit identified at time of analysis; EPSS is low (0.25%, 16th percentile) and it is not listed in CISA KEV, and the vulnerability is classified as Information Disclosure rather than remote code execution.

v1 Jun 24, 2026 - 18:32

Cross-origin Digest authentication state leakage in libcurl allows a maliciously positioned server to receive HTTP Digest credentials intended for a different origin, exploiting curl's connection reuse logic. Rated MEDIUM severity by the curl project, CVE-2026-11856 is one of 18 security issues resolved in the coordinated curl 8.21.0 release on June 24, 2026. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the credential-theft nature warrants prompt patching in any environment where curl or libcurl is used with HTTP Digest authentication across multiple origins.

RemediationAI

Upgrade libcurl to the fixed release published in the curl project advisory at https://curl.se/docs/CVE-2026-11856.html; the input data does not include a confirmed exact fix version, so verify the patched version directly from that advisory before deploying (no vendor-released patch version is independently confirmed from the provided data - do not assume a version number). As a code-level mitigation until patched, applications should avoid reusing the same easy handle across transfers to different HTTP origins, or explicitly reset credential state between such transfers (for example calling curl_easy_reset on the handle, or clearing CURLOPT_USERPWD/CURLOPT_HTTPAUTH before switching origins); the trade-off is loss of connection/state reuse and a minor performance cost. Additionally, prefer not to use Digest auth against endpoints where the destination origin can change dynamically or be influenced by untrusted input, and scope credentials to a dedicated handle per origin.

Affected VersionsENISA

curl 7.23.0 ≤7.23.0
curl 7.15.0 ≤7.15.0
curl 7.62.0 ≤7.62.0
curl 7.27.0 ≤7.27.0
curl 7.19.2 ≤7.19.2
curl 7.58.0 ≤7.58.0
curl 7.43.0 ≤7.43.0
curl 8.12.1 ≤8.12.1
curl 8.18.0 ≤8.18.0
curl 7.42.1 ≤7.42.1
curl 7.18.0 ≤7.18.0
curl 7.20.0 ≤7.20.0
curl 7.60.0 ≤7.60.0
curl 7.54.1 ≤7.54.1
curl 7.59.0 ≤7.59.0
curl 8.5.0 ≤8.5.0
curl 7.28.0 ≤7.28.0
curl 8.10.1 ≤8.10.1
curl 7.18.1 ≤7.18.1
curl 7.87.0 ≤7.87.0
curl 7.71.0 ≤7.71.0
curl 8.20.0 ≤8.20.0
curl 7.11.0 ≤7.11.0
curl 7.22.0 ≤7.22.0
curl 7.79.1 ≤7.79.1
curl 7.14.0 ≤7.14.0
curl 7.61.1 ≤7.61.1
curl 8.19.0 ≤8.19.0
curl 7.28.1 ≤7.28.1
curl 7.47.0 ≤7.47.0
curl 7.19.4 ≤7.19.4
curl 7.40.0 ≤7.40.0
curl 7.65.1 ≤7.65.1
curl 7.42.0 ≤7.42.0
curl 7.56.1 ≤7.56.1
curl 7.18.2 ≤7.18.2
curl 7.35.0 ≤7.35.0
curl 7.77.0 ≤7.77.0
curl 7.63.0 ≤7.63.0
curl 7.64.0 ≤7.64.0
curl 7.48.0 ≤7.48.0
curl 7.49.0 ≤7.49.0
curl 8.14.1 ≤8.14.1
curl 7.86.0 ≤7.86.0
curl 7.11.1 ≤7.11.1
curl 8.3.0 ≤8.3.0
curl 7.17.1 ≤7.17.1
curl 8.11.1 ≤8.11.1
curl 8.10.0 ≤8.10.0
curl 7.65.0 ≤7.65.0
curl 7.16.4 ≤7.16.4
curl 7.56.0 ≤7.56.0
curl 7.19.7 ≤7.19.7
curl 8.1.2 ≤8.1.2
curl 7.34.0 ≤7.34.0
curl 7.16.2 ≤7.16.2
curl 7.44.0 ≤7.44.0
curl 7.12.2 ≤7.12.2
curl 7.36.0 ≤7.36.0
curl 7.69.1 ≤7.69.1
curl 7.16.1 ≤7.16.1
curl 7.54.0 ≤7.54.0
curl 7.20.1 ≤7.20.1
curl 7.83.0 ≤7.83.0
curl 8.0.1 ≤8.0.1
curl 7.17.0 ≤7.17.0
curl 7.26.0 ≤7.26.0
curl 8.14.0 ≤8.14.0
curl 7.66.0 ≤7.66.0
curl 7.15.3 ≤7.15.3
curl 7.52.1 ≤7.52.1
curl 7.21.7 ≤7.21.7
curl 7.49.1 ≤7.49.1
curl 8.4.0 ≤8.4.0
curl 8.7.1 ≤8.7.1
curl 7.53.1 ≤7.53.1
curl 7.19.1 ≤7.19.1
curl 7.52.0 ≤7.52.0
curl 7.70.0 ≤7.70.0
curl 7.50.2 ≤7.50.2
curl 7.78.0 ≤7.78.0
curl 8.11.0 ≤8.11.0
curl 7.21.5 ≤7.21.5
curl 8.15.0 ≤8.15.0
curl 7.45.0 ≤7.45.0
curl 8.7.0 ≤8.7.0
curl 7.15.5 ≤7.15.5
curl 7.14.1 ≤7.14.1
curl 7.38.0 ≤7.38.0
curl 7.13.2 ≤7.13.2
curl 7.53.0 ≤7.53.0
curl 7.21.1 ≤7.21.1
curl 8.1.1 ≤8.1.1
curl 8.2.1 ≤8.2.1
curl 7.69.0 ≤7.69.0
curl 7.46.0 ≤7.46.0
curl 7.55.1 ≤7.55.1
curl 8.2.0 ≤8.2.0
curl 7.65.3 ≤7.65.3
curl 7.11.2 ≤7.11.2
curl 7.81.0 ≤7.81.0
curl 8.9.0 ≤8.9.0
curl 8.12.0 ≤8.12.0
curl 7.68.0 ≤7.68.0
curl 8.0.0 ≤8.0.0
curl 7.21.2 ≤7.21.2
curl 8.13.0 ≤8.13.0
curl 7.13.1 ≤7.13.1
curl 7.16.0 ≤7.16.0
curl 7.39.0 ≤7.39.0
curl 7.15.4 ≤7.15.4
curl 7.10.6 ≤7.10.6
curl 7.57.0 ≤7.57.0
curl 7.30.0 ≤7.30.0
curl 7.29.0 ≤7.29.0
curl 7.88.0 ≤7.88.0
curl 7.64.1 ≤7.64.1
curl 7.82.0 ≤7.82.0
curl 7.51.0 ≤7.51.0
curl 7.80.0 ≤7.80.0
curl 7.21.6 ≤7.21.6
curl 7.71.1 ≤7.71.1
curl 8.9.1 ≤8.9.1
curl 8.8.0 ≤8.8.0
curl 7.12.0 ≤7.12.0
curl 7.24.0 ≤7.24.0
curl 7.23.1 ≤7.23.1
curl 7.72.0 ≤7.72.0
curl 7.10.8 ≤7.10.8
curl 8.1.0 ≤8.1.0
curl 7.50.3 ≤7.50.3
curl 7.21.0 ≤7.21.0
curl 7.79.0 ≤7.79.0
curl 7.76.0 ≤7.76.0
curl 7.41.0 ≤7.41.0
curl 7.50.1 ≤7.50.1
curl 7.32.0 ≤7.32.0
curl 7.85.0 ≤7.85.0
curl 7.15.1 ≤7.15.1
curl 7.67.0 ≤7.67.0
curl 7.37.1 ≤7.37.1
curl 7.31.0 ≤7.31.0
curl 7.12.1 ≤7.12.1
curl 7.74.0 ≤7.74.0
curl 8.17.0 ≤8.17.0
curl 7.15.2 ≤7.15.2
curl 7.75.0 ≤7.75.0
curl 7.50.0 ≤7.50.0
curl 7.25.0 ≤7.25.0
curl 7.61.0 ≤7.61.0
curl 7.19.0 ≤7.19.0
curl 7.65.2 ≤7.65.2
curl 7.21.3 ≤7.21.3
curl 7.19.5 ≤7.19.5
curl 7.83.1 ≤7.83.1
curl 7.12.3 ≤7.12.3
curl 7.84.0 ≤7.84.0
curl 7.19.6 ≤7.19.6
curl 7.76.1 ≤7.76.1
curl 8.16.0 ≤8.16.0
curl 8.6.0 ≤8.6.0
curl 7.88.1 ≤7.88.1
curl 7.37.0 ≤7.37.0
curl 7.33.0 ≤7.33.0
curl 7.47.1 ≤7.47.1
curl 7.10.7 ≤7.10.7
curl 7.55.0 ≤7.55.0
curl 7.19.3 ≤7.19.3
curl 7.16.3 ≤7.16.3
curl 7.21.4 ≤7.21.4
curl 7.13.0 ≤7.13.0
curl 7.73.0 ≤7.73.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libcurl is the transfer library underlying the curl command-line tool and is embedded in a vast range of applications, languages and appliances. The bug lives in libcurl's HTTP Digest authentication state handling: when a single easy handle is reused for sequential transfers (a common performance pattern to reuse connections and state), the credential material bound to the first origin's Digest challenge is not correctly scoped and cleared when the target origin changes. The result is that the 'Authorization:' header calculated for hostA is emitted on the request to hostB. This is a CWE-200/CWE-522-class flaw (exposure of sensitive information / insufficiently protected credentials); the NVD record lists CWE as N/A. Affected versions per the EUVD span essentially the entire modern curl history (7.10.6 up to and including 8.20.0), indicating a long-standing state-management defect rather than a recent regression.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (CNA) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.9 MEDIUM

Requires the specific handle-reuse and origin-change sequence with Digest auth, so AC:H; impact is credential disclosure only, hence C:H with I:N/A:N, unlike the inflated 9.8.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Red Hat 6.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVSS changed
Jul 06, 2026 - 19:22 NVD
9.8 (CRITICAL)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

libcurl versions 7.10.6 through 8.20.0 inadvertently expose authentication credentials to unintended service recipients when applications reuse network connections, creating a direct path to credential compromise across organizations' multi-service ecosystems. Though no public exploit has been identified, the credential exposure presents a significant risk to authentication controls and downstream service access. Any organization using these curl versions should prioritize credential rotation and architectural remediation.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Refactor applications to create separate curl easy handles for each destination instead of reusing connections across services; (2) Rotate all HTTP Digest credentials to invalidate potentially exposed tokens; (3) Implement per-origin authentication token isolation at the application layer; (4) Monitor authentication logs for suspicious origin-credential pairings; (5) Consider migrating to certificate-based or token-based authentication with mandatory per-destination isolation.

Threat Intelligence Overview

EPSS Score
0.2%
Top 84% exploitable
Prevalence
Ubiquitous
libcurl is embedded in countless apps, OSes, and language runtimes worldwide
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-294 – Authentication Bypass by Capture-replay

View all
CVE-2017-3191 CRITICAL
9.8
CVE-2026-62911 HIGH POC
8.0
CVE-2017-6823 HIGH POC
8.8
CVE-2023-1886 CRITICAL POC
9.8
CVE-2023-1537 CRITICAL POC
9.8
CVE-2022-29334 CRITICAL POC
9.8
CVE-2021-27289 CRITICAL POC
9.1
CVE-2022-31277 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-11856 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://vuldb.com/vuln/376067 REF https://curl.se/docs/CVE-2026-11856.html REF https://curl.se/docs/CVE-2026-11856.json REF https://hackerone.com/reports/3793260

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy