CVE-2026-86409
stale SigV4 headers sent unintended
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
Setting CURLOPT_AWS_SIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL is set next, leaking state
information.
INFO
An application that reuses an easy handle, retains CURLOPT_USERPWD credentials, relies on the documented NULL reset, and then performs a request to an attacker-influenced URL unintentionally sends a signed SigV4 Authorization: header to that destination. The header
exposes the access-key identifier and a request-bound signature. The secret key is not transmitted.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-86409 to this issue.
CWE-201: Information Exposure Through Sent Data
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 7.75.0 to and including 8.21.0
- Not affected versions: curl < 7.75.0 and >= 8.22.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/08e8455dddc5e48e58a12ade3
libcurl is used by many applications, but not always advertised as such!
This flaw is not accessible using the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.22.0
B - Apply the patch to your local version
C - Make sure no attempts to NULL this option is done
TIMELINE
This issue was reported to the curl project on August 27, 2026.
curl 8.22.0 was released on September 2, 2026. This advisory was published on October 14, 2026.
CREDITS
- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Viktor Szakats
Thanks a lot!