VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jul 3, 2026· Updated Sep 15, 2026

CVE-2026-11856

CVE-2026-11856

Description

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

19

Patches

Vulnerability mechanics

References

3

News mentions

2