CVE-2026-86409

Published: Ott 20, 2026 Last Modified: Ott 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,
contrary to expectations and documentation. A subsequent transfer on the same
handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL
isset next, leaking state information.

https://curl.se/docs/CVE-2026-86409.html
https://curl.se/docs/CVE-2026-86409.html
https://curl.se/docs/CVE-2026-86409.json
https://curl.se/docs/CVE-2026-86409.json
https://hackerone.com/reports/3973135
https://hackerone.com/reports/3973135