Read the docs
TI-2026-10231 Aliases CVE-2026-11856GHSA-9crq-qh8v-6xmm

cross-origin Digest auth state leak

Priority HIGH 82CWE-294Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 13 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-294.

Summary

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00688 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial curl (curl): 8.14.2, 8.16.1, 8.20.1Red Hat: 10 advisoriesRed Hat: 13 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
curlcurl7.10.6 to before 8.14.2; 8.15.0 to before 8.16.1; 8.17.0 to before 8.20.18.14.2, 8.16.1, 8.20.1Patch availableCNA
curlcurl8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1; 8.7.0; 8.6.0; 8.5.0; 8.4.0; 8.3.0; 8.2.1; 8.2.0; 8.1.2; 8.1.1; 8.1.0; 8.0.1; 8.0.0; 7.88.1; 7.88.0; 7.87.0; 7.86.0; 7.85.0; 7.84.0; 7.83.1; 7.83.0; 7.82.0; 7.81.0; 7.80.0; 7.79.1; 7.79.0; 7.78.0; 7.77.0; 7.76.1; 7.76.0; 7.75.0; 7.74.0; 7.73.0; 7.72.0; 7.71.1; 7.71.0; 7.70.0; 7.69.1; 7.69.0; 7.68.0; 7.67.0; 7.66.0; 7.65.3; 7.65.2; 7.65.1; 7.65.0; 7.64.1; 7.64.0; 7.63.0; 7.62.0; 7.61.1; 7.61.0; 7.60.0; 7.59.0; 7.58.0; 7.57.0; 7.56.1; 7.56.0; 7.55.1; 7.55.0; 7.54.1; 7.54.0; 7.53.1; 7.53.0; 7.52.1; 7.52.0; 7.51.0; 7.50.3; 7.50.2; 7.50.1; 7.50.0; 7.49.1; 7.49.0; 7.48.0; 7.47.1; 7.47.0; 7.46.0; 7.45.0; 7.44.0; 7.43.0; 7.42.1; 7.42.0; 7.41.0; 7.40.0; 7.39.0; 7.38.0; 7.37.1; 7.37.0; 7.36.0; 7.35.0; 7.34.0; 7.33.0; 7.32.0; 7.31.0; 7.30.0; 7.29.0; 7.28.1; 7.28.0; 7.27.0; 7.26.0; 7.25.0; 7.24.0; 7.23.1; 7.23.0; 7.22.0; 7.21.7; 7.21.6; 7.21.5; 7.21.4; 7.21.3; 7.21.2; 7.21.1; 7.21.0; 7.20.1; 7.20.0; 7.19.7; 7.19.6; 7.19.5; 7.19.4; 7.19.3; 7.19.2; 7.19.1; 7.19.0; 7.18.2; 7.18.1; 7.18.0; 7.17.1; 7.17.0; 7.16.4; 7.16.3; 7.16.2; 7.16.1; 7.16.0; 7.15.5; 7.15.4; 7.15.3; 7.15.2; 7.15.1; 7.15.0; 7.14.1; 7.14.0; 7.13.2; 7.13.1; 7.13.0; 7.12.3; 7.12.2; 7.12.1; 7.12.0; 7.11.2; 7.11.1; 7.11.0; 7.10.8; 7.10.7; 7.10.6—No fix listedCNA
  • curl Vendorcurl Affected 7.10.6 to before 8.14.2; 8.15.0 to before 8.16.1; 8.17.0 to before 8.20.1 Fixed in 8.14.2, 8.16.1, 8.20.1 Patch available CNA
  • curl Vendorcurl Affected 8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1; 8.7.0; 8.6.0; 8.5.0; 8.4.0; 8.3.0; 8.2.1; 8.2.0; 8.1.2; 8.1.1; 8.1.0; 8.0.1; 8.0.0; 7.88.1; 7.88.0; 7.87.0; 7.86.0; 7.85.0; 7.84.0; 7.83.1; 7.83.0; 7.82.0; 7.81.0; 7.80.0; 7.79.1; 7.79.0; 7.78.0; 7.77.0; 7.76.1; 7.76.0; 7.75.0; 7.74.0; 7.73.0; 7.72.0; 7.71.1; 7.71.0; 7.70.0; 7.69.1; 7.69.0; 7.68.0; 7.67.0; 7.66.0; 7.65.3; 7.65.2; 7.65.1; 7.65.0; 7.64.1; 7.64.0; 7.63.0; 7.62.0; 7.61.1; 7.61.0; 7.60.0; 7.59.0; 7.58.0; 7.57.0; 7.56.1; 7.56.0; 7.55.1; 7.55.0; 7.54.1; 7.54.0; 7.53.1; 7.53.0; 7.52.1; 7.52.0; 7.51.0; 7.50.3; 7.50.2; 7.50.1; 7.50.0; 7.49.1; 7.49.0; 7.48.0; 7.47.1; 7.47.0; 7.46.0; 7.45.0; 7.44.0; 7.43.0; 7.42.1; 7.42.0; 7.41.0; 7.40.0; 7.39.0; 7.38.0; 7.37.1; 7.37.0; 7.36.0; 7.35.0; 7.34.0; 7.33.0; 7.32.0; 7.31.0; 7.30.0; 7.29.0; 7.28.1; 7.28.0; 7.27.0; 7.26.0; 7.25.0; 7.24.0; 7.23.1; 7.23.0; 7.22.0; 7.21.7; 7.21.6; 7.21.5; 7.21.4; 7.21.3; 7.21.2; 7.21.1; 7.21.0; 7.20.1; 7.20.0; 7.19.7; 7.19.6; 7.19.5; 7.19.4; 7.19.3; 7.19.2; 7.19.1; 7.19.0; 7.18.2; 7.18.1; 7.18.0; 7.17.1; 7.17.0; 7.16.4; 7.16.3; 7.16.2; 7.16.1; 7.16.0; 7.15.5; 7.15.4; 7.15.3; 7.15.2; 7.15.1; 7.15.0; 7.14.1; 7.14.0; 7.13.2; 7.13.1; 7.13.0; 7.12.3; 7.12.2; 7.12.1; 7.12.0; 7.11.2; 7.11.1; 7.11.0; 7.10.8; 7.10.7; 7.10.6 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*7.10.6 to before 8.21.0VulnerableHaxx
  • cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.10.6 to before 8.21.0 Vulnerable ·Haxx

Remediation

  • Fix · CNA curl (curl) Fixed in 8.14.2, 8.16.1, 8.20.1

Red Hat 10 advisories

  • RHSA-2026:93454 Released 2026-11-02 · Red Hat rating Important
    curl security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libcurl-devel-7.76.1-31.el9_6.4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) curl-7.76.1-31.el9_6.4, curl-minimal-7.76.1-31.el9_6.4, libcurl-7.76.1-31.el9_6.4 +1
  • RHSA-2026:92368 Released 2026-10-29 · Red Hat rating Important
    curl security, bug fix, and enhancement update
    • Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-34.el8_10.18, libcurl-7.61.1-34.el8_10.18, libcurl-devel-7.61.1-34.el8_10.18 +1
  • RHSA-2026:82939 Released 2026-10-14 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
Show 7 more Red Hat advisories
  • RHSA-2026:80511 Released 2026-10-12 · Red Hat rating Moderate
    curl security update
    • Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-40.el9_8.8
    • Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-40.el9_8.8, curl-minimal-7.76.1-40.el9_8.8, libcurl-7.76.1-40.el9_8.8 +1
  • RHSA-2026:79357 Released 2026-10-08 · Red Hat rating Important
    Red Hat Cost Management On-Premise container image update
    • Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
  • RHSA-2026:72506 Released 2026-09-28 · Red Hat rating Important
    curl security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libcurl-devel-8.12.1-1.el10_0.10
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) curl-8.12.1-1.el10_0.10, libcurl-8.12.1-1.el10_0.10, libcurl-minimal-8.12.1-1.el10_0.10
  • RHSA-2026:69125 Released 2026-09-21 · Red Hat rating Important
    curl security update
    • Red Hat Enterprise Linux AppStream (v. 10) libcurl-devel-8.12.1-4.el10_2.6
    • Red Hat Enterprise Linux BaseOS (v. 10) curl-8.12.1-4.el10_2.6, libcurl-8.12.1-4.el10_2.6, libcurl-minimal-8.12.1-4.el10_2.6
  • RHSA-2026:56869 Released 2026-08-19 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP5 security update
    • Red Hat JBoss Core Services 2.4.62.SP5
  • RHSA-2026:34975 Released 2026-07-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images cargo-1.96.1-1.hum1@aarch64, cargo-1.96.1-1.hum1@x86_64, clippy-1.96.1-1.hum1@aarch64 +36
  • RHSA-2026:29017 Released 2026-06-24 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images curl-8.21.0-0.1.hum1@aarch64, curl-8.21.0-0.1.hum1@src, curl-8.21.0-0.1.hum1@x86_64 +6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    curl 8.14.2, 8.16.1, 8.20.1

    13 records Highest priority Priority HIGH 12 HIGH, 1 MEDIUM

    Other records, highest priority first

    Show all 13 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat Cost Management On-Premise 1Fixed RHSA-2026:79357
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:69125
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:80511
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:72506
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:93454
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:69125
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:92368
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:80511
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:72506
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:93454
Red Hat Hardened ImagesFixed RHSA-2026:29017, RHSA-2026:34975
Red Hat JBoss Core Services 2.4.62.SP5Fixed RHSA-2026:56869
Red Hat Update Infrastructure 5Fixed RHSA-2026:82939
Not affected: 3 products
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Dev Spaces
  • Red Hat Trusted Profile Analyzer

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11856
  2. 2026-10-03 Alias added: GHSA-9crq-qh8v-6xmm
  3. 2026-10-08 Affected versions changed · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:79357 · Red Hat
  5. 2026-10-09 Fix available: Red Hat Cost Management On-Premise 1 · Red Hat
  6. 2026-10-12 Fix available: RHSA-2026:80511 · Red Hat
  7. 2026-10-12 Fix available: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat
  8. 2026-10-14 Fix available: RHSA-2026:56869 · Red Hat
  9. 2026-10-16 Fix available: RHSA-2026:82939 · Red Hat
  10. 2026-10-16 Fix available: Red Hat JBoss Core Services 2.4.62.SP5, Red Hat Update Infrastructure 5 · Red Hat
  11. 2026-10-29 Fix available: RHSA-2026:92368 · Red Hat
  12. 2026-10-29 Fix available: Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat
  13. 2026-10-30 Affected versions changed · Red Hat
  14. 2026-11-02 Fix available: RHSA-2026:93454 · Red Hat
  15. 2026-11-02 Fix available: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6) · Red Hat
  16. 2026-11-06 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Advisory 1

  • TI-2023-19922 Out-of-bounds write in curl CVSS 3.1CRITICAL 9.8
  • TI-2026-16162 Negotiate ambient user conn reuse CVSS 3.1CRITICAL 9.8
  • TI-2026-09063 HTTP/2 stream-dependency tree UAF CVSS 3.1CRITICAL 9.8
  • TI-2026-07976 stale proxy password leak CVSS 3.1CRITICAL 9.8
  • TI-2026-07845 SASL double-free CVSS 3.1CRITICAL 9.8
  • TI-2026-77670 Credential leak in curl redirects to URLs with userinfo CVSS 3.1CRITICAL 9.1
See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences