CVE-2026-11856: cross-origin Digest auth state leak
cross-origin Digest auth state leak
Other sources
Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-11
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11856?
CVE-2026-11856 has a risk rating of 28, indicating a potential moderate severity vulnerability.
How do I fix CVE-2026-11856?
To mitigate CVE-2026-11856, ensure that you do not reuse libcurl handles across different HTTP origins when using Digest authentication.
What type of authentication does CVE-2026-11856 involve?
CVE-2026-11856 involves Digest authentication in libcurl.
What can attackers do with the vulnerability CVE-2026-11856?
Attackers can exploit CVE-2026-11856 to gain unauthorized access by leaking authentication credentials intended for one origin to another.
Which software is affected by CVE-2026-11856?
CVE-2026-11856 affects the libcurl software library.