CVE-2026-86409

Discovered by AISLEPUBLISHEDCWE-201

Description

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.

CVSS Base Scores

CVSS v3.1(Primary)
3.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products

VendorProductVersionStatus
curl——

References