Bug 2496770 (CVE-2026-9546)

Summary:	CVE-2026-9546 libcurl: libcurl: Information disclosure due to persistent Referer header
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, bbrownin, csutherl, dbosanac, dpaolell, gtanzill, jbuscemi, jclere, jdelft, jmitchel, jreimann, jupierce, kshier, lgarciaa, mbiarnes, mdessi, mrizzi, pcattana, pjindal, plodge, ppalepu, ppostler, prdhamdh, rekumar, rhel-process-autobot, sdawley, sghai, sidsharm, stcannon, suppawar, szappis, teagle, vchlup, vlaad, vvoronko, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in libcurl. This vulnerability causes the HTTP Referer header to persist even after it has been explicitly cleared. This can lead to the previous referrer string being unintentionally reused and sent in subsequent requests, potentially disclosing sensitive information to unintended servers.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2553446, 2553447, 2553448, 2553449, 2553450, 2553452, 2497438, 2509787, 2553445, 2553451
Bug Blocks:

Description OSIDB Bzimport 2026-07-03 07:02:10 UTC

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even
when explicitly cleared. While the documentation states that passing NULL to
`CURLOPT_REFERER` suppresses the header, the option failed to clear the
internal state. As a result the previous referrer string was erroneously
reused and sent in subsequent requests, potentially leaking sensitive
information to unintended servers.