by Kastro
Paper/Archive/CVE-2026-11856

CVE-2026-11856

curl curl — cross-origin Digest auth state leak

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.7.527 × 2010.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.

Affected

ProductAffectedFixed inSource
curl7.10.6 – < 8.14.28.14.2CNA
curl8.15.0 – < 8.16.18.16.1CNA
curl8.17.0 – < 8.20.18.20.1CNA
curl334d78cd18a7310144383929bdcef34ffbf6159b – < 5c6b4880357ab3e72967c1c45cae0f96ffabc5355c6b4880357ab3e72967c1c45cae0f96ffabc535CNA
curl8.20.0–CNA
curl8.19.0–CNA
curl8.18.0–CNA
curl8.17.0–CNA
curl8.16.0–CNA
curl8.15.0–CNA
curl8.14.1–CNA
curl8.14.0–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refcurl.se/docs/CVE-2026-11856.jsonrefcurl.se/docs/CVE-2026-11856.htmlexploithackerone.com/reports/3793260