Skip to main content

libcurl CVE-2026-9546

| EUVDEUVD-2026-41494 HIGH
Information Exposure (CWE-200)
2026-06-24 GHSA-25rx-86v8-32c6
Information Disclosure Curl Haxx
7.5
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Set sensitive Referer on reused handle
  2. Delivery
    Clear referrer via CURLOPT_REFERER NULL
  3. Exploit
    Stale state not reset in libcurl
  4. Execution
    Referer re-sent to unintended server
  5. Impact
    Sensitive URL data disclosed in logs

Vulnerability Assessment

Weakness
CWE
CWE-200
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK

2 techniques across 2 tactics: Collection, Discovery

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a specific application usage pattern, not a special attacker capability: the calling program must reuse the same libcurl easy handle across multiple requests, must have set a (sensitive) referrer on an earlier request, and must then attempt to suppress it by setting CURLOPT_REFERER to NULL on a subsequent request destined for a different server - at which point the stale referrer leaks. Limiting factors that reduce real-world risk: it only affects libcurl 8.18.0-8.20.0; it does not trigger for applications that use a fresh handle per request, that never set a referrer, or that never clear it; the attacker gains value only if the destination server is one they can observe and the leaked referrer actually contains sensitive data. The CVSS PR:N/UI:N flags overstate this because the leak is driven by victim application logic rather than any direct unauthenticated attacker action.
Impact

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) rates this High, but that score overstates real-world risk and its metrics are debatable: the leak is not something a remote attacker directly triggers by sending traffic - it depends on the victim application reusing an easy handle and clearing the referrer, so effective attack complexity is higher and the confidentiality impact is closer to Low than High (only referrer strings leak, not arbitrary data). This is corroborated by a low EPSS of 0.21% (11th percentile), no KEV listing, and no public exploit code - signals that agree this is a low-priority, low-likelihood issue despite the High CVSS. The confidentiality outcome also depends entirely on whether the leaked referrer contains anything sensitive and whether the unintended server is attacker-controlled. Net: treat as a hygiene/patch-in-normal-cycle item rather than an emergency; the High CVSS is an outlier versus every exploitation signal.
Exploit ScenarioDerived

An application uses a long-lived libcurl easy handle: for one request it sets a referrer containing a sensitive internal URL, then for a later request to a different, attacker-observed third-party host it sets CURLOPT_REFERER to NULL expecting no Referer header. Because the state is not cleared, the earlier sensitive referrer is transmitted to that third-party server, where an operator can read it from access logs. No public exploit code exists; exploitation is passive observation rather than an active attack.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 06, 2026

Information disclosure in libcurl (versions 8.18.0 through 8.20.0) causes the HTTP Referer header to persist on a reused easy handle even after an application explicitly clears it by passing NULL to CURLOPT_REFERER. Because the internal referrer state is not reset, a previously set referrer string is silently re-sent on later requests, potentially leaking sensitive URL data (paths, tokens, or query parameters) to unintended destination servers. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 11th percentile), and it is not listed in CISA KEV.

Earlier versions of this analysis (2)
v2 Jul 06, 2026 - 18:39 cvss changed CVSS 7.5

Information disclosure in libcurl 8.18.0 through 8.20.0 allows the HTTP Referer header to leak to unintended servers because passing NULL to CURLOPT_REFERER fails to clear the internal referrer state as documented. Applications that reuse an easy handle across requests to different hosts and rely on clearing the referrer will erroneously resend the prior Referer value, potentially exposing sensitive URLs or tokens. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the flaw is not in CISA KEV.

v1 Jun 24, 2026 - 18:26

Stale HTTP Referer header leak in curl causes the tool to transmit a Referer value from a previous request to a subsequent, unrelated destination where that header should not appear. Affected versions span curl up to and including 8.20.0, and the flaw was fixed in curl 8.21.0 released June 24, 2026. No public exploit exists and the issue carries a LOW severity rating from the curl project; however, it can expose sensitive URL path or query-parameter data from prior requests to unintended third-party servers. No public exploit identified at time of analysis.

RemediationAI

Upgrade libcurl to a fixed release above 8.20.0 as published in the curl security advisory at https://curl.se/docs/CVE-2026-9546.html; the input data does not contain an exact fixed version number, so confirm the patched version directly from that advisory rather than assuming one (patch available per vendor advisory, exact fix version not present in provided data). As an application-level workaround until you can update, do not rely on CURLOPT_REFERER=NULL to clear the header on a reused handle - instead either call curl_easy_reset() on the handle before reuse, use a fresh easy handle per logical request, or explicitly set CURLOPT_REFERER to an empty/known-safe value; the trade-off of curl_easy_reset() is that it clears all other options too, requiring you to re-apply your configuration. Applications that never reuse handles or never set a referrer are not exposed.

Affected VersionsENISA

curl 8.19.0 ≤8.19.0
curl 8.18.0 ≤8.18.0
curl 8.20.0 ≤8.20.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libcurl is the ubiquitous C transfer library underpinning curl and embedded in countless applications, languages, and appliances for HTTP(S) requests. The flaw lies in CURLOPT_REFERER handling: the documented contract is that setting the option to NULL suppresses the Referer header, but the code failed to clear the associated internal state, so the stale referrer value survived across requests made on the same reused easy handle. The root cause class is best described by CWE-459 (Incomplete Cleanup) / CWE-200 (Exposure of Sensitive Information); the input lists CWE as N/A, so this classification is inferred. Referer strings frequently embed sensitive context (originating URLs, session identifiers, single-use tokens), which is why leaking them to a third-party server matters.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI 3.7 LOW

Leak depends on a specific handle-reuse-and-clear pattern (AC:H) and exposes only referrer strings to a third party (C:L); no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Red Hat 7.5 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVSS changed
Jul 06, 2026 - 18:22 NVD
7.5 (HIGH)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

Applications using libcurl 8.18.0-8.20.0 may inadvertently transmit sensitive authentication tokens and API credentials to third-party servers through unintended HTTP headers on connection reuse. Organizations should inventory affected systems immediately to prevent credential exposure and potential unauthorized access. No public exploit has been identified at time of analysis, though the vulnerability poses material information-disclosure risk.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Modify application development practices to create new connection handles per request rather than reusing connections across multiple external destinations; (2) Configure HTTP headers explicitly to prevent unintended credential leakage; (3) Implement data sanitization to ensure sensitive tokens and parameters are not transmitted in URLs; (4) Deploy network-layer monitoring to detect and alert on unexpected header values in outbound traffic; (5) Establish vendor alert monitoring process for libcurl security updates and patched releases.

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Prevalence
Ubiquitous
libcurl is embedded in vast numbers of applications, OSes, and appliances
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2021-41277 HIGH POC
7.5
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP6-CHOST-BYOS Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun Not-Affected
SLES15-SP6-CHOST-BYOS-Azure Not-Affected
SLES15-SP6-CHOST-BYOS-EC2 Not-Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:29017 ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9546 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://vuldb.com/vuln/376078 REF https://curl.se/docs/CVE-2026-9546.html REF https://curl.se/docs/CVE-2026-9546.json REF https://hackerone.com/reports/3754343

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy