Low
stale SigV4 headers sent unintended
Type: advisorySources: OSV
Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-86409
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:40 UTC · Revision 1
Source evidence
Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.
osv:CURL-CVE-2026-86409
Complete source record
{
"id": "3d9b9343dabbb31100ac2b01128324a66a1b111ec06de2cd2be4585cfb5cec5d",
"url": "https://osv.dev/vulnerability/CURL-CVE-2026-86409",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "stale SigV4 headers sent unintended",
"summary": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.",
"evidence": "osv:CURL-CVE-2026-86409",
"products": [],
"severity": "low",
"structured": {
"id": "CURL-CVE-2026-86409",
"aliases": [
"CURL-CVE-2026-86409",
"CVE-2026-86409"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.75.0"
},
{
"fixed": "8.14.3"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.2"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.20.2"
},
{
"introduced": "8.21.0"
},
{
"fixed": "8.22.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "08e8455dddc5e48e58a12ade3815c01ae3da3b64"
},
{
"fixed": "c3c70440e8d9938c0bb732595751e8aebc614f24"
}
]
}
],
"versions": [
"8.21.0",
"8.20.0",
"8.19.0",
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"8.11.0",
"8.10.1",
"8.10.0",
"8.9.1",
"8.9.0",
"8.8.0",
"8.7.1",
"8.7.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"rc-8_22_0-3",
"rc-8_22_0-2",
"rc-8_22_0-1",
"curl-8_21_0",
"rc-8_21_0-3",
"rc-8_21_0-2",
"rc-8_21_0-1",
"curl-8_20_0",
"rc-8_20_0-3",
"rc-8_20_0-2",
"rc-8_20_0-1",
"curl-8_19_0",
"rc-8_19_0-3",
"rc-8_19_0-2",
"rc-8_19_0-1",
"curl-8_18_0",
"rc-8_18_0-3",
"rc-8_18_0-2",
"rc-8_18_0-1",
"curl-8_17_0",
"curl-8_16_0",
"curl-8_15_0",
"curl-8_14_1",
"curl-8_14_0",
"curl-8_13_0",
"curl-8_12_1",
"curl-8_12_0",
"curl-8_11_1",
"curl-8_11_0",
"curl-8_10_1",
"curl-8_10_0",
"curl-8_9_1",
"curl-8_9_0",
"curl-8_8_0",
"curl-8_7_1",
"curl-8_7_0",
"curl-8_6_0",
"curl-8_5_0",
"tiny-curl-8_4_0",
"curl-8_4_0",
"curl-8_3_0",
"curl-8_2_1",
"curl-8_2_0",
"curl-8_1_2",
"curl-8_1_1",
"curl-8_1_0",
"curl-8_0_1",
"curl-8_0_0",
"curl-7_88_1",
"curl-7_88_0",
"curl-7_87_0",
"curl-7_86_0",
"curl-7_85_0",
"curl-7_84_0",
"curl-7_83_1",
"curl-7_83_0",
"curl-7_82_0",
"curl-7_81_0",
"curl-7_80_0",
"curl-7_79_1",
"curl-7_79_0",
"curl-7_78_0",
"curl-7_77_0",
"curl-7_76_1",
"curl-7_76_0",
"curl-7_75_0"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2026-86409.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2026-86409-62bc7d3a",
"digest": {
"length": 1878,
"function_hash": "296301210058830896882707982146318434592"
},
"source": "https://github.com/curl/curl.git/commit/c3c70440e8d9938c0bb732595751e8aebc614f24",
"target": {
"file": "tests/libtest/lib1978.c",
"function": "test_lib1978"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-86409-8a823472",
"digest": {
"threshold": 0.9,
"line_hashes": [
"148730934911534517830614376719825974679",
"247335704167197139135844766476960907729",
"310154762111448113114589494662291412643",
"292483950422029214771039948662655987950"
]
},
"source": "https://github.com/curl/curl.git/commit/c3c70440e8d9938c0bb732595751e8aebc614f24",
"target": {
"file": "lib/setopt.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-86409-aea9d465",
"digest": {
"threshold": 0.9,
"line_hashes": [
"254023202749963606167260577621680122363",
"293626129652972113769201831412836230079",
"290144920303614811414442527806988356606",
"11125639011853470230106167921614138568"
]
},
"source": "https://github.com/curl/curl.git/commit/c3c70440e8d9938c0bb732595751e8aebc614f24",
"target": {
"file": "tests/libtest/lib1978.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-86409-e06ab2ce",
"digest": {
"length": 2038,
"function_hash": "145560211488761754850862030928430648447"
},
"source": "https://github.com/curl/curl.git/commit/c3c70440e8d9938c0bb732595751e8aebc614f24",
"target": {
"file": "lib/setopt.c",
"function": "setopt_cptr_http_mqtt"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:16:47Z"
}
}
],
"modified": "2026-10-25T01:16:47.956837797Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-201",
"desc": "Information Exposure Through Sent Data"
},
"URL": "https://curl.se/docs/CVE-2026-86409.json",
"www": "https://curl.se/docs/CVE-2026-86409.html",
"issue": "https://hackerone.com/reports/3973135",
"affects": "lib",
"package": "curl",
"severity": "Low",
"last_affected": "8.21.0"
}
},
"related_cves": [
{
"value": "CVE-2026-86409",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444445,
"published_at": "2026-10-14T08:00:00+00:00"
}