CURL-CVE-2026-11856: cross-origin Digest auth state leak
Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using libcurl are exposed when they successfully authenticate to one HTTP origin with Digest authentication, then change to a different origin and perform another transfer with the same handle. The issue concerns reuse of a handle across distinct origins.
What does an attacker need to exploit it?
An attacker needs to receive the second transfer at a different HTTP origin after the reused handle has previously completed a Digest-authenticated transfer to another origin. No attacker authentication or user interaction is indicated by the provided severity vector.
What information can be disclosed?
The Authorization header intended for the first origin can be sent to the second origin. This can expose Digest authentication state associated with the first origin to the second origin.
What can be done if patching is not immediately possible?
Do not reuse a libcurl handle for transfers to different HTTP origins after it has been used with Digest authentication. Use a separate handle for each origin or avoid changing the origin on a handle that has performed Digest authentication.
How can I determine whether my application is affected?
Review code paths that reuse libcurl handles and change the HTTP origin between transfers. Affected behavior requires a successful Digest-authenticated transfer to one origin followed by a transfer to a different origin using that same handle.