Executive brief
A vulnerability in the libcurl library, which is widely used by applications to transfer data over the internet, could allow a malicious server to impersonate a user. When an application uses the same connection handle to talk to a secure site and then a second site, libcurl may mistakenly send the first site's security credentials to the second one. This could allow the second site to reuse those credentials to access the user's account on the original secure site.
Technical details
A cross-origin state leak exists in libcurl's Digest authentication implementation. When a single easy handle is used for a transfer to 'hostA' using Digest authentication and subsequently reused for a transfer to 'hostB', libcurl fails to clear the authenticated state. Consequently, the 'Authorization:' header intended for 'hostA' is incorrectly transmitted to 'hostB'. An attacker controlling 'hostB' could capture this header and attempt to replay it to impersonate the client on 'hostA'. This issue is specific to the libcurl library and does not affect the curl command-line tool. The vulnerability is mitigated by the fact that the header does not reveal the identity of 'hostA' and credentials themselves are not directly exposed, limiting the attack to replaying specific requests.
Affected products
- curl curl 7.10.6 to 8.20.0
Timeline
- 2026-06-10: disclosed: Reported to the curl project via HackerOne.
- 2026-06-24: patched: Fixed in curl version 8.21.0.
- 2026-06-24: advisory: Project curl security advisory published.