Live › vulnerability › CVE-2026-86409
Go to dashboardSetting CURLOPT_AWS_SIGV4 to NULL does not turn off AWS SigV4 signing, so the next transfer on the same handle still sends an AWS4-HMAC-SHA256 Authorization header. The header goes to whatever URL is requested next, which can leak signing state to an unintended host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use libcurl with CURLOPT_AWS_SIGV4, reuse one easy handle for several transfers, and clear that option between requests. Code that never sets SigV4 or uses a fresh handle per transfer is not exposed. The sources do not say which libcurl versions are fixed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Setting CURLOPT_AWS_SIGV4 to NULL but does not disable SigV4 authentication,
contrary to expectations and documentation. A subsequent transfer on the same
handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL
isset next, leaking state information.
This page as .md · .json · in your agent: get_signal("CVE-2026-86409")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.