CVE-2026-9546
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability in libcurl causes the HTTP `Referer:` header to persist even when explicitly cleared. According to the documentation, passing NULL to `CURLOPT_REFERER` should suppress the header, but the option fails to clear the internal state. As a result, the previous referrer string is erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.
Risk Assessment
The risk involves uncontrolled disclosure of sensitive data (e.g., session URLs or parameters) to external servers, which may compromise user privacy and application security.
Recommendation
Immediately update libcurl to a patched version. Until the update is applied, avoid using `CURLOPT_REFERER` with NULL or manually clear the header before each request.
Other vulnerabilities in libcurl
See all- CVE-2022-27782High
libcurl has an issue with reusing previously created connections even when TLS or SSH-related options have been changed that should prohibit reuse. Several TLS and SSH settings were left out from the configuration match checks, making them match too easily.
- CVE-2022-27781High
libcurl provides the `CURLOPT_CERTINFO` option to allow applications to request details about a server's certificate chain. Due to an erroneous function, a malicious server could make libcurl built with NSS get stuck in a never-ending busy-loop when trying to retrieve that information.
- CVE-2021-22926High
libcurl-using applications can request a specific client certificate to be used in a transfer. When built with the macOS native TLS library Secure Transport, a malicious user can trick the application into using a file-based certificate instead of the intended one, leading to the wrong client certificate being sent in the TLS handshake.
- CVE-2017-1000254High
libcurl may read outside of a heap allocated buffer when doing FTP. A flaw in the string parser for the directory name may lead to a missing NUL byte at the end of the buffer, resulting in the potential to read data beyond the allocated memory area.
- CVE-2016-5421High
Use-after-free vulnerability in libcurl before version 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
- CVE-2016-0755High
The ConnectionExists function in lib/url.c in libcurl before version 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request.
- CVE-2024-6874Medium
The curl_url_get() function in libcurl offers punycode conversions to and from IDN. When converting a name that is exactly 256 bytes, libcurl reads outside a stack-based buffer when built with the macidn IDN backend.
- CVE-2024-2398Medium
A vulnerability in the libcurl library causes a memory leak when handling HTTP/2 server push. When an application allows server push and the number of headers exceeds the limit of 1000, libcurl aborts the push but fails to free previously allocated headers.
- CVE-2025-4947Medium
libcurl accidentally skips certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
- CVE-2024-6197High
libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. It can detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte local stack buffer. Most modern malloc implementations detect this error and immediately abort.
Original NVD description (English source)
A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.