CVE Feed

    Dashboard / CVE / CVE-2026-86409

    CVE-2026-86409

    Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.

    Published:Oct 14, 2026
    Last Modified:Oct 29, 2026
    EPS:Oct 20, 2026
    EPSS Score:0.00313
    CVSS Score:8.1

    Affected Products

    Vendor
    Curl
    Product
    Curl

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-86410 (CVSS 8.1) — A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting …
    CVE-2026-94266 (CVSS 7.5) — libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing…
    CVE-2026-87862 (CVSS 8.1) — Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child.…
    CVE-2026-92391 (CVSS 7.5) — A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl dur…
    CVE-2026-94265 (CVSS 9.1) — When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might er…
    CVE-2026-86415 (CVSS 7.5) — libcurl's connection cache match function never considers the automatic client certificate option, so a cached…
    CVE-2026-92387 (CVSS 8.1) — By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can explo…
    CVE-2026-87861 (CVSS 9.1) — When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connectio…
    CVE-2026-92390 (CVSS 7.5) — When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protect…
    CVE-2026-107928 (CVSS 8.1) — When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. T…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86409 — Curl (High 8.1) | CVE-DB