Is CVE-2026-9546 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9546 being exploited in the wild.

How severe is CVE-2026-9546?

Informational severity, published 3 July 2026.

Is there a fix for CVE-2026-9546?

A patch was published on 2026-06-24: Fixed in version 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9546 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9546?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9546: curl libcurl information exposure via persistent Referer header

CVE-2026-9546 · Severity: info · Published 2026-07-03

A vulnerability in the libcurl library, which is widely used by applications to transfer data over the internet, could cause sensitive information to be leaked. When an application attempts to clear the 'Referer' header (which tracks the previous webpage visited), the library fails to do so and instead sends the old information to subsequent servers. This could result in private URLs or session data being shared with unintended third parties.

Quick answers

Is CVE-2026-9546 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9546 being exploited in the wild.
How severe is CVE-2026-9546?: Informational severity, published 3 July 2026.
Which products and versions are affected?: curl curl 8.18.0 to 8.20.0.
Is there a fix for CVE-2026-9546?: A patch was published on 2026-06-24: Fixed in version 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9546 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9546?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw in libcurl's handling of the CURLOPT_REFERER option prevents the internal state from being cleared when a NULL value is passed. According to documentation, passing NULL should suppress the header; however, the library erroneously reuses the previous referrer string in subsequent requests. This is classified as an information exposure (CWE-200). The issue affects libcurl versions 8.18.0 through 8.20.0 and is fixed in version 8.21.0. The curl command-line tool is not affected.

Affected products

curl curl 8.18.0 to 8.20.0

Timeline

2026-05-22: disclosed: Reported to the curl project via HackerOne
2026-06-24: patched: Fixed in version 8.21.0
2026-06-24: advisory: Project curl security advisory published
2026-07-03: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.