CVE-2026-11856

CRITICAL

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 7/3/2026Modified: 9/15/2026

Related Intelligence (1)

CRITICALApt

Hitachi Energy RTU500 Product

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-293-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to

CVE-2026-17539CVE-2026-28388
CISA Advisories

References (4)

https://curl.se/docs/CVE-2026-11856.htmlPatchVendor Advisoryhttps://curl.se/docs/CVE-2026-11856.jsonVendor Advisoryhttps://hackerone.com/reports/3793260ExploitIssue Trackinghttps://hackerone.com/reports/3793260ExploitIssue Tracking