{
  "threat_severity" : "Moderate",
  "public_date" : "2026-07-03T06:13:31Z",
  "bugzilla" : {
    "description" : "curl: curl: Information disclosure via incorrect Digest authentication header reuse",
    "id" : "2496767",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2496767"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-201",
  "details" : [ "Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the  `Authorization:` header field meant for `hostA`,\nto `hostB`.", "A flaw was found in curl. When `libcurl` performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data." ],
  "statement" : "This Moderate-severity flaw in `libcurl` can lead to information disclosure when an application reuses a `libcurl` handle for transfers to different HTTP origins while using Digest authentication. The vulnerability arises from `libcurl` incorrectly sending the authentication header intended for the initial origin to a subsequent, different origin. This could expose sensitive authentication data to an unintended recipient, potentially compromising user credentials or session information. The only observed impact from this flaw is an integrity impact.\n- libcurl only — the curl CLI is not affected\n- Requires an application to reuse an easy handle across different HTTP origins while Digest auth state is attached — a specific programming pattern\n- Credentials themselves are not leaked; only the authenticated state (\"Authorization: ...\" HTTP header)\n- Fixed in curl 8.21.0; affected range: 7.10.6 – 8.20.0",
  "affected_release" : [ {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-24T00:00:00Z",
    "advisory" : "RHSA-2026:29017",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "curl-main-8.21.0-0.1.hum1",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-02T00:00:00Z",
    "advisory" : "RHSA-2026:34975",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "rust-main-1.96.1-1.hum1",
    "impact" : "moderate"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "curl",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "curl",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "curl",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "curl",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "curl",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "rhcos",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces",
    "fix_state" : "Not affected",
    "package_name" : "devspaces/code-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3"
  }, {
    "product_name" : "Red Hat Trusted Profile Analyzer",
    "fix_state" : "Not affected",
    "package_name" : "rhtpa/rhtpa-trustification-service-rhel9",
    "cpe" : "cpe:/a:redhat:trusted_profile_analyzer:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-11856\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-11856\nhttps://curl.se/docs/CVE-2026-11856.html\nhttps://curl.se/docs/CVE-2026-11856.json\nhttps://hackerone.com/reports/3793260" ],
  "name" : "CVE-2026-11856",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0",
    "lang" : "en:us"
  },
  "csaw" : false
}