Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-11856: libcurl Passes Wrong Passwords Between Websites
CURL-CVE-2026-11856
CVE-2026-11856
CVE-2026-11856
Summary
A bug in libcurl can cause it to accidentally send passwords meant for one website to another. This can happen if you use libcurl to log in to a website with a password, and then try to access another website using the same connection. To fix this, update to the latest version of libcurl.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| curl | curl | <= 8.20.0 |
Original title
Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a second transfer, reusi...
Original description
Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Authorization:` header field meant for `hostA`,
to `hostB`.
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the `Authorization:` header field meant for `hostA`,
to `hostB`.
Vulnerability type
CWE-294
Published: 3 Jul 2026 · Updated: 23 Jul 2026 · First seen: 24 Jun 2026