{"id":"CVE-2026-86409","kind":"vulnerability","aliases":["CVE-2026-86409"],"related":[],"title":"curl: clearing CURLOPT_AWS_SIGV4 leaves SigV4 auth active on the handle","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information.","summary":"Setting CURLOPT_AWS_SIGV4 to NULL does not turn off AWS SigV4 signing, so the next transfer on the same handle still sends an AWS4-HMAC-SHA256 Authorization header. The header goes to whatever URL is requested next, which can leak signing state to an unintended host.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","libcurl","native-code","package"],"not_affected_if":["fresh-handle-per-transfer","no-aws-sigv4-option"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:39+00:00","updated_at":"2026-10-25T05:04:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:04:39Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"curl: clearing CURLOPT_AWS_SIGV4 leaves SigV4 auth active on the handle","impact":"low","summary":"Setting CURLOPT_AWS_SIGV4 to NULL does not turn off AWS SigV4 signing, so the next transfer on the same handle still sends an AWS4-HMAC-SHA256 Authorization header. The header goes to whatever URL is requested next, which can leak signing state to an unintended host.","category":"package","nicknames":[],"who_cares":["libcurl","c","native-code"],"confidence":0.6,"needs_auth":"unknown","worst_case":"SigV4 signing state is sent to an unintended URL on the same handle","analyst_note":"Find the fixed libcurl version and the NVD CVSS score; the sources give no severity or fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-aws-sigv4-option","fresh-handle-per-transfer"],"who_is_affected":"Applications that use libcurl with CURLOPT_AWS_SIGV4, reuse one easy handle for several transfers, and clear that option between requests. Code that never sets SigV4 or uses a fresh handle per transfer is not exposed. The sources do not say which libcurl versions are fixed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000582,"input_tokens":3329,"output_tokens":499,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86409':15A,18A 'activ':9A 'auth':8A 'authent':84C 'author':53B,100C 'aw':4A,27B,35B,75C 'aws4':50B,102C 'aws4-hmac-sha256':49B,101C 'c':19B 'clear':2A 'code':23B 'contrari':85C 'curl':1A 'curlopt':3A,26B,74C 'cve':13A,16A 'disabl':82C 'document':89C 'expect':87C 'goe':57B 'handl':12A,45B,96C 'header':54B,56B,105C 'hmac':51B,103C 'host':72B 'inform':113C 'isset':109C 'leak':66B,111C 'leav':6A 'libcurl':20B 'nativ':22B 'native-cod':21B 'next':40B,63B,110C 'null':30B,78C 'packag':24B 'request':62B 'send':47B,98C 'set':25B,73C 'sha256':52B,104C 'sign':37B,67B 'sigv4':5A,7A,28B,36B,76C,83C 'state':68B,112C 'still':46B,97C 'subsequ':91C 'transfer':41B,92C 'turn':33B 'unintend':71B 'url':60B,108C 'whatev':59B,107C","nicknames":[],"mitigations":[],"who_affected":"Applications that use libcurl with CURLOPT_AWS_SIGV4, reuse one easy handle for several transfers, and clear that option between requests. Code that never sets SigV4 or uses a fresh handle per transfer is not exposed. The sources do not say which libcurl versions are fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T20:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","severity":null,"published_at":"2026-10-20T20:17:25+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}