CVE-2026-86409: stale SigV4 headers sent unintended
Published Oct 20, 2026
·Updated
Last updated 14 October 2026
Other sources
Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information.
— MITRE
Affected Software
1 affected componentFixes available
debian/curl<=7.88.1-10+deb12u15, <=7.88.1-10+deb12u5, <=8.14.1-2+deb13u5, <=8.14.1-2+deb13u7
8.22.0-18.23.0-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.22.0-1Fixed in 8.23.0-1
Event History
Oct 14, 2026
CVE Published
via Ubuntu·09:52 PM
Data Sourced
via Ubuntu·09:52 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·09:53 PM
DescriptionAffected Software
Oct 20, 2026
CVE Published
via MITRE·07:57 PM
Data Sourced
via MITRE·07:57 PM
DescriptionWeakness
Data Sourced
via NVD·08:17 PM
Description