CVE-2026-9546

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9546", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-05-26T06:45:18.723Z", "datePublished": "2026-07-03T06:18:14.447Z", "dateUpdated": "2026-09-15T06:03:33.325Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:03:33.325Z"}, "title": "sending old referer", "descriptions": [{"lang": "en", "value": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.18.0", "status": "affected", "versionType": "semver", "lessThan": "8.20.1"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "2cb868242dc2ac9cd52ee64987ef51d5964a56f9", "status": "affected", "versionType": "git", "lessThan": "862e8a74a84478d82973471b4f49dc2746c1780e"}], "defaultStatus": "unaffected", "repo": "https://github.com/curl/curl.git"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8.20.0", "status": "affected"}, {"version": "8.19.0", "status": "affected"}, {"version": "8.18.0", "status": "affected"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-9546.json"}, {"url": "https://curl.se/docs/CVE-2026-9546.html"}, {"url": "https://hackerone.com/reports/3754343"}], "x_osv": {"schema_version": "1.5.0", "id": "CURL-CVE-2026-9546", "aliases": ["CVE-2026-9546"], "summary": "sending old referer", "modified": "2026-09-07T10:34:51.00Z", "database_specific": {"package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2026-9546.json", "www": "https://curl.se/docs/CVE-2026-9546.html", "issue": "https://hackerone.com/reports/3754343", "CWE": {"id": "CWE-200", "desc": "Exposure of Sensitive Information to an Unauthorized Actor"}, "last_affected": "8.20.0", "severity": "Low"}, "published": "2026-06-24T08:00:00.00Z", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.18.0"}, {"fixed": "8.20.1"}]}, {"type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [{"introduced": "2cb868242dc2ac9cd52ee64987ef51d5964a56f9"}, {"fixed": "862e8a74a84478d82973471b4f49dc2746c1780e"}]}], "versions": ["8.20.0", "8.19.0", "8.18.0"]}], "credits": [{"name": "renjian on hackerone", "type": "finder"}, {"name": "Daniel Stenberg", "type": "remediation developer"}], "details": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "renjian on hackerone", "type": "finder"}, {"lang": "en", "value": "Daniel Stenberg", "type": "remediation developer"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://hackerone.com/reports/3754343", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T16:51:06.094113Z", "id": "CVE-2026-9546", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T16:51:49.410Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-9546", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T16:51:06.094113Z"}}}], "references": [{"url": "https://hackerone.com/reports/3754343", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T16:51:43.961Z"}}], "cna": {"title": "sending old referer", "x_osv": {"id": "CURL-CVE-2026-9546", "aliases": ["CVE-2026-9546"], "credits": [{"name": "renjian on hackerone", "type": "finder"}, {"name": "Daniel Stenberg", "type": "remediation developer"}], "details": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers.", "summary": "sending old referer", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.18.0"}, {"fixed": "8.20.1"}]}, {"repo": "https://github.com/curl/curl.git", "type": "GIT", "events": [{"introduced": "2cb868242dc2ac9cd52ee64987ef51d5964a56f9"}, {"fixed": "862e8a74a84478d82973471b4f49dc2746c1780e"}]}], "versions": ["8.20.0", "8.19.0", "8.18.0"]}], "modified": "2026-09-07T10:34:51.00Z", "published": "2026-06-24T08:00:00.00Z", "schema_version": "1.5.0", "database_specific": {"CWE": {"id": "CWE-200", "desc": "Exposure of Sensitive Information to an Unauthorized Actor"}, "URL": "https://curl.se/docs/CVE-2026-9546.json", "www": "https://curl.se/docs/CVE-2026-9546.html", "issue": "https://hackerone.com/reports/3754343", "affects": "lib", "package": "curl", "severity": "Low", "last_affected": "8.20.0"}}, "credits": [{"lang": "en", "type": "finder", "value": "renjian on hackerone"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Stenberg"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.18.0", "lessThan": "8.20.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "2cb868242dc2ac9cd52ee64987ef51d5964a56f9", "lessThan": "862e8a74a84478d82973471b4f49dc2746c1780e", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-9546.json"}, {"url": "https://curl.se/docs/CVE-2026-9546.html"}, {"url": "https://hackerone.com/reports/3754343"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:03:33.325Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9546", "state": "PUBLISHED", "dateUpdated": "2026-09-15T06:03:33.325Z", "dateReserved": "2026-05-26T06:45:18.723Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2026-07-03T06:18:14.447Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThan": "8.20.1", "status": "affected", "version": "8.18.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "curl", "repo": "https://github.com/curl/curl.git", "vendor": "curl", "versions": [{"lessThan": "862e8a74a84478d82973471b4f49dc2746c1780e", "status": "affected", "version": "2cb868242dc2ac9cd52ee64987ef51d5964a56f9", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF934FA-9E74-432D-A41E-157D65C6B539", "versionEndExcluding": "8.21.0", "versionStartIncluding": "8.18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}], "id": "CVE-2026-9546", "lastModified": "2026-09-15T07:16:35.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9546", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T16:51:06.094113Z", "version": "2.0.3"}}]}, "published": "2026-07-03T07:16:25.893", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Patch", "Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-9546.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Third Party Advisory"], "url": "https://curl.se/docs/CVE-2026-9546.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3754343"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3754343"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "libcurl: libcurl: Information disclosure due to persistent Referer header", "id": "2496770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496770"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers.", "A flaw was found in libcurl. This vulnerability causes the HTTP Referer header to persist even after it has been explicitly cleared. This can lead to the previous referrer string being unintentionally reused and sent in subsequent requests, potentially disclosing sensitive information to unintended servers."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-9546", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Affected", "package_name": "libcurl-1.dll", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Affected", "package_name": "libcurl.so", "product_name": "Red Hat JBoss Core Services"}], "public_date": "2026-07-03T06:18:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-9546\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-9546\nhttps://curl.se/docs/CVE-2026-9546.html\nhttps://curl.se/docs/CVE-2026-9546.json\nhttps://hackerone.com/reports/3754343"], "statement": "Important: A flaw in libcurl allows for sensitive information disclosure. Despite attempts to explicitly clear the HTTP Referer header, its internal state persists, leading to the unintended reuse and transmission of previous referrer strings in subsequent requests. This could expose sensitive data to unintended third-party servers in Red Hat products and services that rely on libcurl for HTTP communications.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.20.0,8.20.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.19.0,8.19.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.18.0,8.18.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "curl", "source": "cna", "vendor": "curl"}, "product": "curl", "vendor": "curl"}], "created": "2026-07-03T07:45:03.409048+00:00", "updated": "2026-09-21T07:15:07.283723+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}