CVE-2026-11856

A flaw was found in curl. When libcurl performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data.

This Moderate-severity flaw in libcurl can lead to information disclosure when an application reuses a libcurl handle for transfers to different HTTP origins while using Digest authentication. The vulnerability arises from libcurl incorrectly sending the authentication header intended for the initial origin to a subsequent, different origin. This could expose sensitive authentication data to an unintended recipient, potentially compromising user credentials or session information. The only observed impact from this flaw is an integrity impact.

• libcurl only — the curl CLI is not affected
• Requires an application to reuse an easy handle across different HTTP origins while Digest auth state is attached — a specific programming pattern
• Credentials themselves are not leaked; only the authenticated state ("Authorization: ..." HTTP header)
• Fixed in curl 8.21.0; affected range: 7.10.6 – 8.20.0

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Correct usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:

// req.A
curl = curl_easy_init();
...
curl_easy_cleanup(curl);


// req.B
curl = curl_easy_init();
...
curl_easy_cleanup(curl);

Fixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0