CURL-CVE-2026-9546: sending old referer
A vulnerability in libcurl caused the HTTP Referer: header to persist even when explicitly cleared. While the documentation states that passing NULL to CURLOPTREFERER suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using libcurl are exposed when they reuse a transfer handle after setting a Referer value and then attempt to suppress it by passing NULL to CURLOPT_REFERER. Subsequent requests may send the earlier referrer to unintended servers.
What does an attacker need to exploit the issue?
An attacker needs to receive a subsequent HTTP request from an affected application after that application has previously set a sensitive Referer value and tried to clear it. No authentication or user interaction is required according to the supplied severity vector.
How can I tell whether an application may be affected?
Review libcurl usage for transfer handles on which CURLOPT_REFERER is first set to a value and later set to NULL before reuse. Capture or log outgoing HTTP headers on the subsequent request to determine whether the prior Referer value is still transmitted.