7.5Yüksek

CVE-2026-9546sending old referer

curl curl Yayım: 2026-07-03 09:18 (4 ay önce)

Açıklama

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.

Zayıflık türü (CWE): CWE-200

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
curl	curl	8.18.0 – < 8.20.1
haxx	curl	8.18.0 – < 8.21.0

Kaynaklar ve yamalar

https://curl.se/docs/CVE-2026-9546.json Third Party Advisory
https://curl.se/docs/CVE-2026-9546.html PatchVendor Advisory
https://hackerone.com/reports/3754343 ExploitIssue TrackingThird Party Advisory

CPE eşleşmeleri (NVD) (1)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* ≥ 8.18.0 < 8.21.0

CVSS puanı

7.5Yüksek

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yok
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tüm puanlar (2)

CISA-ADP	CVSS 3.1	7.5Yüksek
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.5Yüksek

EPSS (30 günde istismar olasılığı)

0.65%

tüm CVE'lerin %52'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: poc
Otomatikleştirilebilir: yes
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2026-05-26
Yayımlandı2026-07-03 09:18
IP-DB'ye ulaştı2026-10-24 23:46
Son güncelleme2026-09-15 10:16

Numarayı veren (CNA): curl
NVD durumu: Modified

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — curl / libcurl

8.1Yüksek

CVE-2026-107929 22 gün önce

local interface connection reuse mixup

curl curl

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…

8.1Yüksek

CVE-2026-107928 22 gün önce

info leak uploading over WebSockets with GnuTLS

curl curl

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…

7.5Yüksek

CVE-2026-94266 22 gün önce

password leak in CURLINFO_EFFECTIVE_URL

curl curl

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

9.1Kritik

CVE-2026-94265 22 gün önce

Authorization: Negotiate sent to foreign origin

curl curl

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…

7.5Yüksek

CVE-2026-92391 22 gün önce

curl_mime_free stack overflow by recursion

curl curl

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…

1.2%EPSS

7.5Yüksek

CVE-2026-92390 22 gün önce

-J no-clobber guarantee bypassed with 103 early hints

curl curl

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…