CVE-2026-11856 Details
Description
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.
A vulnerability exists in curl and libcurl versions 7.10.6 prior to 8.21.0, allowing a cross-origin leak of Digest authentication headers. When the same easy handle is reused for transfers to different HTTP origins, the Authorization header intended for the first origin is incorrectly sent to the second. This flaw enables an attacker controlling the second origin to impersonate the client by replaying the authorization header to the first origin, potentially leading to unauthorized access or actions.
Users are advised to upgrade curl and libcurl to version 8.21.0 or later. If an upgrade is not possible, the vulnerability can be mitigated by avoiding the reuse of easy handles when changing origins.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3793260 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-11856.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-11856.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3793260 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
| CWE-294 | Authentication Bypass by Capture-replay | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.10.6, < 8.21.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | curl |