CVEvulnerability
CVE-2026-86409
- Status
- Awaiting Analysis
- Published
- 2026-10-20
- Last modified
- 2026-10-22
- Assigner
- 2499f714-1537-4658-8207-48ae4bb9eae9
Description
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,
contrary to expectations and documentation. A subsequent transfer on the same
handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL
isset next, leaking state information.
References
- https://curl.se/docs/CVE-2026-86409.html curl.se
- https://curl.se/docs/CVE-2026-86409.json curl.se
- https://hackerone.com/reports/3973135 hackerone.com